An attempted intrusion against Chilean interbank network Redbanc used a fake LinkedIn developer-job approach to persuade an employee to run ApplicationPDF.exe. The .NET downloader displayed a fake job application form while contacting a C2 server, writing Reg_Time.ps1 to c:\users\public\, and executing a PowerShell payload that closely matched the PowerSpritz family. The excerpt links the tooling to suspected North Korea-aligned financial intrusion activity, including Vietnam-centered banking infrastructure cases involving hs.exe and syschk.ps1, while treating possible Pakistan activity as lower confidence. Reported artifacts include multiple hashes, PowerShell command routines, encrypted logging to c:\windows\temp\tmp0914.tmp, and infrastructure such as 38.132.124[.]250 and 89.249.65[.]220.