VIPKeyLogger - ENCRYPTED.ps1

Question 4: What is the content of ExecutionPayload?

Before moving to the analysis of stage3.exe, the content of ExecutionPayload can be found without even having to use any breakpoint. Note the start of the array of numbers: it is 77 90, which is the same as stage3.exe, so another executable file. Using the “From Decimal” recipe as before, with the comma delimiter, the whole content of ExecutionPayload can be pasted and saved to file. It has been named invocationParam.exe to remember that it is used as an argument of the stage3.exe.